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SUMMARY: The departments and agencies 
listed in this document announce 
revisions to modernize, strengthen, and 
make more effective the Federal Policy 
for the Protection of Human Subjects 
that was originally promulgated as a 
Common Rule in 1991. This final rule 
is intended to better protect human 
subjects involved in research, while 
facilitating valuable research and 
reducing burden, delay, and ambiguity 
for investigators. These revisions are an 
effort to modernize, simplify, and 
enhance the current system of oversight. 
DATES: This rule is effective on January 
19, 2018. The compliance date for this 
tule, except for§ —_.114(b) 
(cooperative research), is January 19, 
2018. The compliance date for 

§ _.114(b) (cooperative research) is 
January 20, 2020. 

ADDRESSES: Jerry Menikoff, M.D., J.D., 
OHRP, 1101 Wootton Parkway, Suite 
200, Rockville, MD 20852. 

FOR FURTHER INFORMATION CONTACT: Jerry 
Menikoff, M.D., J.D., Office for Human 
Research Protections (OHRP), 
Department of Health and Human 
Services, 1101 Wootton Parkway, Suite 
200, Rockville, MD 20852; telephone: 
240-453-6900 or 1-866—447-—4777; 
facsimile: 301-402-2071; email: 
jerry.menikoff@hhs.gov. 
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Executive Summary 


Purpose of the Regulatory Action 


Individuals who are the subjects of 
research may be asked to contribute 
their time and assume risk to advance 
the research enterprise, which benefits 
society at large. U.S. federal regulations 
governing the protection of human 
subjects in research have been in 
existence for more than three decades. 
The Department of Health, Education, 
and Welfare first published regulations 
for the protection of human subjects in 
1974, and the Department of Health and 
Human Services (HHS) revised them in 
the early 1980s. During the 1980s, HHS 
began a process that eventually led to 
the adoption of a revised version of the 
regulations by 15 U.S. federal 
departments and agencies in 1991. The 
purpose of this effort was to promote 
uniformity, understanding, and 
compliance with human subject 
protections as well as to create a 
uniform body of regulations across 
federal departments and agencies 
(subpart A of 45 Code of Federal 
Regulations [CFR] part 46), often 
referred to as the ‘Common Rule” or 
“Protection of Human Subjects 
Regulations.” Those regulations were 
last amended in 2005, and have 
remained unchanged until the issuance 
of this final rule. 
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Since the Common Rule was 
promulgated, the volume and landscape 
of research involving human subjects 
have changed considerably. Research 
with human subjects has grown in scale 
and become more diverse. Examples of 
developments include: an expansion in 
the number and types of clinical trials, 
as well as observational studies and 
cohort studies; a diversification of the 
types of social and behavioral research 
being used in human subjects research; 
increased use of sophisticated analytic 
techniques to study human 
biospecimens; and the growing use of 
electronic health data and other digital 
records to enable very large datasets to 
be rapidly analyzed and combined in 
novel ways. Yet these developments 
have not been accompanied by major 
change in the human subjects research 
oversight system, which has remained 
largely unaltered over the past two 
decades. 


On July 26, 2011, the Office of the 
Secretary of HHS, in coordination with 
the Executive Office of the President’s 
Office of Science and Technology Policy 
(OSTP), published an advance notice of 
proposed rulemaking (ANPRM) to 
request comment on how current 
regulations for protecting those who 
participate in research might be 
modernized and revised to be more 
effective.1 


On September 8, 2015, HHS and 15 
other federal departments and agencies 
published a Notice of Proposed 
Rulemaking (NPRM) proposing 
revisions to the regulations for 
protection of human subjects in 
research.? Like the ANPRM, the NPRM 
sought comment on how to better 
protect research subjects while 
facilitating valuable research and 
reducing burden, delay, and ambiguity 
for investigators. Public comments on 
both the ANPRM and the NPRM have 
informed the final rule that is now being 
promulgated. 


The final rule is designed to more 
thoroughly address the broader types of 
research conducted or otherwise 
supported by all of the Common Rule 
departments and agencies such as 
behavioral and social science research. 
It also benefits from continuing efforts 
to harmonize human subjects policies 
across federal departments and 
agencies. 


1 HHS. Human Subjects Research Protections: 
Enhancing Protections for Research Subjects and 
Reducing Burden, Delay, and Ambiguity for 
Investigators. 76 FR 44512 (Jul. 26, 2011). Retrieved 


Summary of the Major Changes in the 
Final Rule 


The final rule differs in important 
ways from the NPRM. Most 
significantly, several proposals are not 
being adopted: 

e The final rule does not adopt the 
proposal to require that research 
involving nonidentified biospecimens 
be subject to the Common Rule, and that 
consent would need to be obtained in 
order to conduct such research. 

e To the extent some of the NPRM 
proposals relied on standards that had 
not yet been proposed, the final rule 
either does not adopt those proposals or 
includes revisions to eliminate such 
reliance. 

e The final rule does not expand the 
policy to cover clinical trials that are not 
federally funded. 

e The final rule does not adopt the 
proposed new concept of ‘‘excluded’’ 
activities. Generally, activities proposed 
to be excluded are now either described 
as not satisfying the definition of what 
constitutes research under the 
regulations or are classified as exempt. 

e The proposed revisions to the 
exemption categories have been 
modified to better align with the long- 
standing ordering in the final rule. The 
final rule does not include the proposed 
requirement that exemption 
determinations need to be made in 
specified ways. 

e The final rule does not include the 
proposed standardized privacy 
safeguards for identifiable private 
information and identifiable 
biospecimens. Aspects of proposals that 
relied on those safeguards have been 
modified or are not being adopted. 

e The final rule does not adopt the 
most restrictive proposed criteria for 
obtaining a waiver of the consent 
requirements relating to research with 
identifiable biospecimens. 

The final rule makes the following 
significant changes to the Common 
Rule: 

e Establishes new requirements 
regarding the information that must be 
given to prospective research subjects as 
part of the informed consent process. 

e Allows the use of broad consent 
(i.e., seeking prospective consent to 
unspecified future research) from a 
subject for storage, maintenance, and 
secondary research use of identifiable 
private information and identifiable 
biospecimens. Broad consent will be an 
optional alternative that an investigator 
may choose instead of, for example, 


from https://www.gpo.gov/fdsys/pkg/FR-2011-07- 
26/pdf/2011-18792.pdf 

2 HHS. Federal Policy for the Protection of 
Human Subjects. 80 FR 53931 (Sept. 8, 2015). 


conducting the research on 
nonidentified information and 
nonidentified biospecimens, having an 
institutional review board (IRB) waive 
the requirement for informed consent, 
or obtaining consent for a specific study. 


e Establishes new exempt categories 
of research based on their risk profile. 
Under some of the new categories, 
exempt research would be required to 
undergo limited IRB review to ensure 
that there are adequate privacy 
safeguards for identifiable private 
information and identifiable 
biospecimens. 


e Creates a requirement for U.S.- 
based institutions engaged in 
cooperative research to use a single IRB 
for that portion of the research that takes 
place within the United States, with 
certain exceptions. This requirement 
becomes effective 3 years after 
publication of the final rule. 

e Removes the requirement to 
conduct continuing review of ongoing 
research for studies that undergo 
expedited review and for studies that 
have completed study interventions and 
are merely analyzing study data or 
involve only observational follow up in 
conjunction with standard clinical care. 


Other minor changes have been to 
improve the rule and for purposes of 
clarity and accuracy. 


Estimated Costs and Benefits 


Table 1 summarizes the quantified 
and nonquantified benefits and costs of 
all changes to the Common Rule. Over 
the 2017-2026 period, present value 
benefits of $1,904 million and 
annualized benefits of $223 million are 
estimated using a 3 percent discount 
rate; present value benefits of $1,494 
million and annualized benefits of $213 
million are estimated using a 7 percent 
discount rate. Present value costs of 
$528 million and annualized costs of 
$62.0 million are estimated using a 3 
percent discount rate; present value 
costs of $474 million and annualized 
costs of $67.0 million are estimated 
using a 7 percent discount rate. 
Nonquantified benefits include 
improved human subjects protections in 
research; enhanced oversight of research 
reviewed by IRBs not operated by a 
Federalwide Assurance (FWA)-holding 
institution; and increased uniformity in 
regulatory requirements among 
Common Rule departments and 
agencies. Nonquantified costs include 
the time needed for consultation among 


Retrieved from https://www.federalregister.gov/ 
documents/2015/09/08/2015-21756/federal-policy- 
for-the-protection-of-human-subjects 
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Common Rule agencies before federal 
guidance is issued. 


TABLE 1—ACCOUNTING TABLE OF BENEFITS AND COSTS OF ALL CHANGES 





Present value of 10 years by 
discount rate 
(millions of 2015 dollars) 


Annualized value over 10 
years by discount rate 
(millions of 2015 dollars) 





3 percent 


7 percent 3 percent 7 percent 





Benefits: 
Quantified Benefits 








1,904 


223 213 








1,493 





Nonquantified Benefits: 


Improved human subjects protections in research; enhanced oversight in research reviewed by IRBs not operated by an FWA-holding insti- 
tution; and increased uniformity in regulatory requirements among Common Rule departments and agencies. 





Costs: 


Quantified Costs .....ccccccccccseccesccseeesseeseeee 


528 








474 62.0 67.0 











Nonquantified Benefits: 


Time for consultation among Common Rule agencies before federal guidance is issued. 





I. The Rationale for Modernizing the 
Common Rule 


A. The Changing Nature of Research 


This final rule recognizes that in the 
past two decades a paradigm shift has 
occurred in how research is conducted. 
Evolving technologies—including 
imaging, mobile technologies, and the 
growth in computing power—have 
changed the scale and nature of 
information collected in many 
disciplines. Computer scientists, 
engineers, and social scientists are 
developing techniques to integrate 
different types of data so they can be 
combined, mined, analyzed, and shared. 
The advent of sophisticated computer 
software programs, the Internet, and 
mobile technology has created new 
areas of research activity, particularly 
within the social and behavioral 
sciences. In biomedical science, the 
Human Genome Project laid the 
foundation for precision medicine and 
promoted an environment of data 
sharing and innovation in analytics and 
technology, and drew attention to the 
need for policies that support a 
changing research landscape. New 
technologies, including genomic 
sequencing, have quickly led to 
exponential growth in the data to which 
investigators have access. The sheer 
volume of data that can be generated in 
research, the ease with which it can be 
shared, and the ways in which it can be 
used to identify individuals were 
simply not possible, or even imaginable, 
when the Common Rule was first 
adopted. 

Research settings are also shifting. 
Although much biomedical research 
continues to be conducted in academic 
medical centers, more research is being 
conducted in clinical care settings, thus 


combining research and medical data. 
Biospecimen repositories and large 
databases have made it easier to do 
research on existing (stored) 
biospecimens and data. Clinical 
research networks connected through 
electronic health records have 
developed methods for extracting 
clinical data for research purposes and 
are working toward integration of 
research data into electronic health 
records in a meaningful way. The 
scientific community recognizes the 
value of data sharing and open-source 
resources and understands that pooling 
intellectual resources and capitalizing 
on efficient uses of data and technology 
represent the best ways to advance 
knowledge. 

At the same time, the level of public 
engagement in the research enterprise 
has changed. More people want to play 
an active role in research, particularly 
related to health. 

As technology evolves, so does the 
nature of the risks and benefits of 
participating in certain types of 
research. Many studies do not involve 
interaction with research subjects, but 
instead involve secondary analysis of 
data or biospecimens. Risks related to 
these types of research studies are 
largely informational, not physical; that 
is, harms could result primarily from 
the inappropriate disclosure of 
information and not from the research 
interventions themselves. Nonetheless, 
those harms can be significant. 

Because of these shifts in science, 
technology, and public engagement and 
expectations, a wide range of 
stakeholders have raised concerns about 
the limitations of the existing regulatory 
framework, arguing for a re-evaluation 
of how the fundamental principles of 


the 1979 Belmont Report* that underlie 
the Common Rule—respect for persons, 
beneficence, and justice—are applied in 
practice to the myriad new contexts in 
which U.S. research is conducted in the 
21st century. The changes that are being 
implemented in the final rule continue 
to be shaped by those principles (a 
detailed background discussion of 
which was provided in the NPRM). 

Finally, it is important to note that, to 
the extent appropriate, the intent is to 
eventually amend the other subparts of 
the HHS human subjects protection 
regulations in 45 CFR part 46 (subparts 
B, G, D, and E), and consider the need 
for updates to FDA regulations and 
other relevant federal departmental or 
agency regulations with overlapping 
scope. 


B. Public Comments, Expert Advice, 
Stakeholder Dialogue 


The revisions to the Common Rule are 
based on a variety of sources of public, 
stakeholder, and expert comments and 
advice, including comments received on 
the 2011 ANPRM and the 2015 NPRM. 
They also benefit from guidance 
provided by a 2014 National Research 
Council consensus report, Proposed 
Revisions to the Common Rule for the 
Protection of Human Subjects in the 
Behavioral and Social Sciences,* and 


3 National Commission for the Protection of 
Human Subjects of Biomedical and Behavioral 
Research. Belmont Report. Washington, DC: U.S. 
Department of Health and Human Services. 1979. 
Retrieved from http://www.hhs.gov/ohrp/ 
humansubjects/guidance/belmont.html. 

4 National Research Council of the National 
Academies. Proposed Revisions to the Common 
Rule for the Protection of Human Subjects in the 
Behavioral and Social Sciences. Washington, DC: 
The National Academies Press; 2014. 13-168. 
Retrieved from http://www.nap.edu/catalog/18614/ 
proposed-revisions-to-the-common-rule-for-the- 

Continued 
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the National Academies of Science, 
Engineering, and Medicine 2016 report 
Optimizing the Nation’s Investment in 
Academic Research: A New Regulatory 
Framework for the 21st Century.® 

Since the publication of the 2011 
ANPRM, HHS has continued to solicit 
public comment on a variety of policy 
issues related to human subjects 
protections, including consent, the use 
of a single IRB for multi-institutional 
studies, and sharing of genomic data. 
Although these policies were more 
specific than the issues raised in the 
ANPRM, the responses received from 
public comments provide insight for 
refining the proposals initially put 
forward in the ANPRM. Of particular 
relevance are the National Institutes of 
Health’s (NIH’s) recently issued policy 
on the use of a single IRB for multi- 
institutional research,® the Office for 
Human Research Protection’s (OHRP’s) 
draft guidance on the required content 
of consent language for research 
conducted within the standard of care,” 
and NIH’s policy to promote sharing of 
large-scale human genomic data 
generated from studies funded or 
conducted by NIH.® 

Other developments include the 
enactment of the Newborn Screening 
Saves Lives Reauthorization Act of 2014 
(Pub. L. 113-240) in December 2014. 
The law made a number of changes 
relevant to the HHS regulations for 
protecting research subjects, including 
asserting that research with newborn 
dried blood spots (DBS) that is federally 
funded pursuant to the Public Health 
Service Act is to be considered research 
with human subjects, and that the 
provisions allowing IRBs to waive 
consent would not apply. By statute, the 
changes made by this law applied only 
until changes to the Common Rule are 
promulgated. Thus, the changes made 
by this statute will no longer apply after 
the effective date of this rule, January 
19, 2018. In addition, in April 2015, the 


protection-of-human-subjects-in-the-behavioral- 
and-social-sciences. 

5 National Academies of Sciences, Engineering, 
and Medicine. Optimizing the Nation’s Investment 
in Academic Research: A New Regulatory 
Framework for the 21st Century. Washington, DC: 
The National Academies Press; 2016. Retrieved 
from https://www.nap.edu/read/21824/chapter/1. 

6 National Institutes of Health. Final NIH Policy 
on the Use of a Single Institutional Review Board 
for Multi-Site Research. June 21, 2016. Notice 
Number: NOT—OD-16-094. Retrieved from https:// 
grants.nih.gov/grants/guide/notice-files/NOT-OD- 
16-094.html. 

7 HHS. Draft Guidance on Disclosing Reasonably 
Foreseeable Risks in Research Evaluating Standards 
of Care. 79 FR 63630 (Oct. 24, 2014). Retrieved from 
https://www.gpo.gov/fdsys/pkg/FR-2014-10-24/pdf/ 
2014-25318.pdf. 

8 Information about the NIH Genomic Data 
Sharing policy is available at https://gds.nih.gov/ 
O3policy2.html. 


Medicare Access and Children’s Health 
Insurance Program Reauthorization Act 
of 2015 (Pub. L. 114-10) was passed. 
That law requires HHS to issue a 
clarification or modification of the 
Common Rule with regard to how the 
regulatory requirements should be 
applied to activities involving clinical 
data registries. In addition, in December 
2016 the 21st Century Cures Act (Pub. 
L. 114-255) was enacted. 

Finally, as a result of conducting a 
variety of public discussions associated 
with the President’s Precision Medicine 
Initiative,9 1°11 many perspectives were 
heard, with much alignment around the 
central tenet that participants should be 
active partners in such research and not 
merely passive subjects of research 
studies. 


1. Summary of Public Comments on 
Structural, Conceptual, and Policy 
Implications of the Proposed Rule 


The NPRM received more than 2,100 
public comments, the majority of which 
were from people writing in their 
individual capacity. The remaining 
comments were submitted by 
institutions, professional organizations 
and societies, and membership 
organizations. The proposals receiving 
the most comments were those related 
to biospecimens (expanded definition of 
human subject, broad consent, and 
tightened criteria for waiver of consent). 
Here we summarize comments on the 
overall structural, conceptual, and 
policy implications of the proposed 
rule. Comments regarding the specific 
provisions of the rule appear throughout 
this preamble. 

The NPRM asked for public comment 
on whether the proposed changes will 
achieve the objectives of: (1) decreasing 
administrative burden, delay, and 
ambiguity for investigators, institutions, 
and institutional review boards (IRBs); 
and (2) strengthening, modernizing, and 
making the regulations more effective in 
protecting research subjects. In 
response, many public commenters 
expressed concern about the overall 
complexity and length of the NPRM, the 
unavailability of key deliverables, 
proposals being internally inconsistent, 


°The White House, Office of the Press Secretary. 
Fact Sheets: President Obama’s Precision Medicine 
Initiative. January 30, 2015. Retrieved from https:// 
www.whitehouse.gov/the-press-office/2015/01/30/ 
fact-sheet-president-obama-s-precision-medicine- 
initiative. 

10 Collins FS, Varmus H. A New Initiative on 
Precision Medicine. The New England Journal of 
Medicine 2015 Feb; 372:793-795. 

11 For more information on the Precision 
Medicine Initiative Cohort Program see https:// 
www.nih.gov/sites/default/files/research-training/ 
initiatives/pmi/pmi-working-group-report- 
20150917-2.pdf. 


and proposals giving investigators too 
much leeway to determine if their 
research is exempt or falls outside the 
scope of the rule. 

Several commenters expressed 
concerns that they were unable to 
adequately or meaningfully comment on 
particular provisions proposed in the 
NPRM because an underlying 
document, tool, or list had not been 
developed or shared with the public at 
the time the NPRM was published, 
specifically: (1) the proposed broad 
consent templates; (2) the proposed 
standards for privacy protection; (3) the 
proposed list of eligible expedited 
procedures; and (4) the proposed 
exemption decision tool. Several 
commenters suggested that these items 
should be removed from the final rule 
and developed independently, urging 
government personnel to work 
collaboratively with representatives 
from the research community and 
funding agencies in the development of 
such documents, tools, and lists. 

Some commenters suggested issuing a 
new NPRM that would be more 
complete and would include details on 
the privacy protection standards, 
exemption decision tool, and broad 
consent templates. Another commenter 
recommended that only the fully 
developed, less controversial provisions 
of the NPRM should be adopted into a 
final rule. Another commenter urged the 
Common Rule departments and 
agencies to reissue the NPRM to solicit 
comment on several of these documents, 
tools, and lists, arguing that it would be 
unlawful for a final rule to be issued 
until such an action were taken. This 
commenter noted that for members of 
the public to reasonably participate in 
rulemaking, agencies must provide 
enough factual detail and rationale to 
allow interested parties to comment 
meaningfully on the rule. This 
commenter also argued that the NPRM 
did not satisfy the requirement set forth 
in the Administrative Procedure Act 
that the notice provided to the public in 
rulemaking include either the terms or 
substance of the proposed rule or a 
description of the subjects and issues 
involved. In sum, the commenter argued 
that the NPRM sought comments on 
numerous provisions without providing 
the “terms or substance”’ of the specific 
proposals. 

Some commenters encouraged 
dropping the proposal to require 
consent for research use of 
nonidentified biospecimens and instead 
exploring a system of public notification 
and opportunity to opt out of such 
research through issuance of a new 
NPRM following widespread 
consultation. A few commenters 
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suggested that Common Rule 
departments and agencies fund pilot 
studies to better understand how such a 
system might work. Additional 
commenters focused on the importance 
of public education about the research 
enterprise regardless of the policy 
choices pursued in a final rule. 


Commenters, including state health 
departments and other health entities 
involved in newborn screening 
activities, raised concerns that several of 
the NPRM proposals represented 
unfunded mandates, specifically the 
expansion of the definition of human 
subject to include all biospecimens 
regardless of identifiability, expansion 
of the policy to apply to all clinical 
trials that meet certain conditions, and 
mandatory single IRB review of 
cooperative research. Several 
institutions and disease advocacy 
groups noted that statewide newborn 
screening programs are often modestly 
funded, and the NPRM proposals would 
impose processes that could cost 
millions of dollars each year. 


In addition, commenters raised 
concerns that HHS and other Common 
Rule departments and agencies are not 
authorized under 42 U.S.C. 289 to 
regulate humanities and social science 
research. 


Public comments also discussed 
several ideas for consideration in a final 
rule that were not otherwise proposed 
in the NPRM, including: 


e Develop or strengthen sanctions 
and penalties for investigators or 
institutions that re-identify subjects 
without proper authorization or review, 
rather than focusing solely on obtaining 
consent as the way to protect subjects. 
To this end, several commenters 
suggested that a separate section be 
added to the Common Rule focused on 
investigator responsibilities. 


e Develop an IRB efficiency rating 
system. 


e Deem research about IRB operations 
as an excluded, exempt, or expeditable 
activity to foster research into IRB 
operations. 


e Include provisions about 
compensation for research-related 
injuries. 

e More fully review and address how 
the rule should or should not apply to 
prisoners, children, and pregnant 
women and fetuses. 


e Include provisions about U.S.- 
funded studies in developing countries 
with regard to defining standards of care 
and addressing post-trial access to 
proven therapies. 


2. Response to Public Comments on 
Structural, Conceptual, and Policy 
Implications of the Proposed Rule 


The final rule differs in numerous, 
major ways from what was proposed in 
the NPRM. Most significantly, the 
provisions relating to making 
nonidentified biospecimens subject to 
the Common Rule are not being 
implemented. That change alone 
addresses many of the public comments 
on the NPRM. Eliminating that proposal 
is intended to address concerns about 
the complexity of and lack of 
justification for the proposed changes in 
the rule, as well as concerns about 
embarking on significant changes 
without evidence that they would 
improve the system. Responses to 
public comments on specific provisions 
appear throughout this preamble. Below 
we summarize our responses to 
comments that addressed major 
structural or organizational issues or 
perceived insufficiencies in the NPRM 
proposals and their presentation. 

Concerns about the overall 
complexity of the proposed changes 
have been addressed in several ways. 
For example, concerns about creating a 
new category of “excluded” activities 
have been addressed by not adopting 
that concept in the final rule. Instead, 
the goal of clarifying what is covered by 
the rule has been accomplished by 
modifying the definition of what 
constitutes research, and by adding or 
modifying exemptions that were already 
in the pre-2018 rule.12 And, even where 
existing concepts are modified, we have 
attempted to make those modifications 
in ways that minimize the extent of the 
change (such as largely preserving much 
of the core structure of the previous 
exemption categories). 

To reduce public concerns about the 
aspects of the proposal that were not yet 
developed, we chose not to implement 
most of those provisions. For example, 
given the changes made to the proposals 
regarding broad consent, the final rule 
does not reference or include the 
concept of broad consent templates. The 
requirement that the Secretary of HHS 
develop a list of proposed privacy 
safeguards has been eliminated, as has 
the proposed exemption decision tool. 
In addition, we have dropped the 
regulatory requirement for the Secretary 


12For purposes of this preamble, the terms ‘“‘pre- 
2018 requirements” or ‘“‘pre-2018 rule” refer to the 
Common Rule as published in the 2016 edition of 
the Code of Federal Regulations (i.e., the Federal 
Policy for the Protection of Human Subjects, 
originally published on June 18, 1991 and 
subsequently amended on June 23, 2005). In 
addition, the term “‘this rule” or “final rule” refers 
to the 2018 requirements as presented in this 
issuance. 


of HHS to publish a list of activities that 
are minimal risk (as was proposed in the 
NPRM in the definition of minimal 
risk). The final rule retains the 
requirement at § .110(a) that the 
Secretary of HHS will establish and 
publish for public comment a list of 
categories of research that may be 
reviewed by an IRB through the 
expedited review procedure, consistent 
with the pre-2018 rule. 

Some of the “new ideas” for altering 
the system for protecting research 
subjects that were presented by 
commenters—for example, addressing 
compensation for research-related 
injuries or the meaning of equivalent 
protections when research is conducted 
in foreign countries—were either very 
innovative or not yet widely discussed. 
This made it difficult to adopt them at 
this point without further study and 
additional notice and opportunity for 
public comment. Therefore, the fact that 
one or another of these ideas was not 
incorporated into the final rule should 
not be viewed as a rejection of their 
possible merits, or an indication that 
they might not be explored in some 
future revision of the Common Rule or 
in guidance. 





a. Process Issues 


We carefully considered concerns 
voiced by commenters about the process 
that led to this final rule, and other legal 
concerns about the adequacy of that 
process. We concluded that the 
approach proposed in the NPRM and 
the approach adopted in this final rule 
are consistent with the Federal 
Government’s obligations under the 
Administrative Procedure Act. 

Regarding the concerns expressed that 
the Common Rule departments and 
agencies are not authorized to regulate 
humanities and social science research, 
this challenge had been asserted 
previously against the 1981 HHS 
protection of human subjects 
regulations,!% as well as the 1991 
Common Rule,?4 and in each case the 
regulatory agencies concluded that the 
regulation of humanities and social 
science research is justified. We 
continue to assert the authority to 
regulate humanities and social science 
research that falls within the scope of 
the final rule. 


13 Federal Regulations Amending Basic HHS 
Policy for the Protection of Human Research 
Subjects; Final Rule, 46 FR8366 (January 26, 1981). 
Retrieved from https://wayback.archive-it.org/all/ 
2016020218291 4/http://archive.hhs.gov/ohrp/ 
documents/19810126.pdf. 

14 Federal Policy for the Protection of Human 
Subjects; Notices and Rules. 56 FR 28002. (June 18, 
1981). Retrieved from https://www.hhs.gov/ohrp/ 
sites/default/files/ohrp/policy/frcomrul. pdf. 
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C. Signatories to the Common Rule 


This section provides information 
about where each Common Rule 
department or agency’s statutory 
authority for enacting and revising 
human subjects research protection 
regulation lies, and provides additional 
information about new signatories to the 
Common Rule. 

The regulations are codified in each 
department or agency’s title or chapter 
of the CFR. The Common Rule was 
based on HHS’s regulations, 45 CFR part 
46, subpart A, and includes identical 
language in the separate regulations of 
each department and agency. 

Although they did not previously 
issue the Common Rule in regulations, 
four departments and agencies have 
historically complied with all subparts 
of the HHS protection of human subjects 
regulations at 45 CFR part 46. These are 
the Central Intelligence Agency (CIA), 
the Office of the Director of National 
Intelligence (ODND, the Department of 
Homeland Security (DHS), and the 
Social Security Administration (SSA). 

Pursuant to Executive Order 12333 of 
December 4, 1981, as amended, 
elements of the Intelligence Community 
must comply with the guidelines issued 
by HHS regarding research on human 
subjects found in 45 CFR part 46. This 
final rule does not supersede the 
Executive Order. The CIA will continue 
to adhere to the HHS regulations at 45 
CFR part 46, pursuant to the Executive 
Order. 

Through this rulemaking, DHS is 
codifying the final rule into its own 
agency regulations. DHS, which was 
created after issuance of the pre-2018 
rule, has been required by statute (Pub. 
L. 108-458, title VIII, section 8306) to 
comply with 45 CFR part 46, or with 
equivalent regulations promulgated by 
the Secretary of Homeland Security or 
his designee. Through this rulemaking, 
DHS is issuing equivalent regulations, 
consistent with statute, and will comply 
with the DHS regulations as the 
requirements will be equivalent to 
compliance with HHS regulations at 45 
CFR part 46, subpart A. 

Through this rulemaking, SSA is 
codifying the final rule into its own 
agency regulations. SSA was separated 
from HHS in 1995 and, pursuant to the 
transition rules provided in Section 106 
of title 1 of Pub. L. 103-296, has been 
required to apply regulations that 
applied to SSA before the separation, 
absent action by the Commissioner. 
With this rulemaking, SSA will follow 
the SSA regulations (adopting the 
provisions of this final rule) instead of 
HHS regulations at 45 CFR part 46, 


subpart A. (See Pub. L. 103-296 §106(b), 
108 Stat. 1464, 1476.) 


The Department of Labor (DOL), 
which was not a signatory to the pre- 
2018 rule, is now a signatory to this 
rulemaking and is codifying the final 
rule in DOL regulations for human 
subjects research that DOL conducts or 
supports. 

The Consumer Product Safety 
Commission (CPSC), subject to 
Commission vote, intends to adopt this 
rule through a separate rulemaking. 


The legal authority for the 
departments and agencies that are 
signatories to this action is as follows: 


Department of Homeland Security, 5 
U.S.C. 301; Pub. L. 107-296, sec. 102, 
306(c); Pub. L. 108-458, sec. 8306. 
Department of Agriculture, 5 U.S.C. 301; 
42 U.S.C. 300v—1(b). Department of 
Energy, 5 U.S.C. 301; 42 U.S.C. 7254; 42 
U.S.C. 300v—1(b). National Aeronautics 
and Space Administration, 5 U.S.C. 301; 
42 U.S.C. 300v—1(b). Department of 
Commerce, 5 U.S.C. 301; 42 U.S.C. 
300v—1(b). Social Security 
Administration, 5 U.S.C. 301; 42 U.S.C. 
289(a). Agency for International 
Development, 5 U.S.C. 301; 42 U.S.C. 
300v—1(b), unless otherwise noted. 
Department of Housing and Urban 
Development, 5 U.S.C. 301; 42 U.S.C. 
300v—1(b) and 3535(d). Department of 
Labor, 5 U.S.C. 301; 29 U.S.C. 551. 
Department of Defense, 5 U.S.C. 301. 
Department of Education, 5 U.S.C. 301; 
20 U.S.C. 1221e—-3, 3474; 42 U.S.C. 
300v—1(b). Department of Veterans 
Affairs, 5 U.S.C. 301; 38 U.S.C. 501, 
7331, 7334; 42 U.S.C. 300v—1(b). 
Environmental Protection Agency, 5 
U.S.C. 301; 7 U.S.C. 136a(a) and 
136w/(a)(1); 21 U.S.C. 346a(e)(1)(C); sec. 
201, Pub. L. 109-54, 119 Stat. 531; and 
42 U.S.C. 300v—1(b). Department of 
Health and Human Services, 5 U.S.C. 
301; 42 U.S.C. 289(a); 42 U.S.C. 300v— 
1(b). National Science Foundation, 5 
U.S.C. 301; 42 U.S.C. 300v—1(b). 
Department of Transportation, 5 U.S.C. 
301; 42 U.S.C. 300v—1(b). 


II. To what does this policy apply? 


Scope and Applicability of the 
Regulations 


This section of the preamble describes 
changes made in the final rule with 
regard to its scope and applicability. 
Specifically, it addresses which entities 
are subject to the rule; coverage of 
clinical trials; department and agency 
discretion in applying the rule; the 
relevance of state and local laws; 
coverage of research conducted in 
foreign countries; the goal of 
harmonizing guidance across the federal 


entities; effective and compliance dates; 
and severability. 


A. IRBs Not Operated by an Institution 
Holding a Federalwide Assurance 


($____.101(a)(1)) 


1. Background and Pre-2018 
Requirements 


Before this final rule, IRBs not 
operated by an institution holding an 
FWA were not directly subject to 
oversight for compliance with the 
Common Rule. In situations in which an 
institution relied on an IRB not operated 
by the institution, OHRP’s practice was 
to hold the institution engaged in 
human subjects research accountable for 
compliance violations, even in 
circumstances in which the regulatory 
violation was directly related to the 
responsibilities of the IRB. 


An institution might rely on an IRB 
not operated by that institution to 
review cooperative research, that is, 
research conducted at more than one 
institution. However, for some, such 
reliance has been considered 
problematic due to lack of direct 
regulatory accountability for these IRBs. 
Previously, the choice to have 
cooperative research reviewed by a 
single IRB was voluntary and, for 
federally funded research, most 
institutions have been reluctant to 
replace review by their own IRB with 
review by a single IRB not operated by 
that institution. 


2. NPRM Proposal To Cover IRBs not 
Operated by an Institution Holding an 
FWA 


For the reasons outlined above, and 
based on comments to OHRP’s 2011 
ANPRM, the NPRM proposed adding a 
new provision at § _.101(a) that 
would explicitly give Common Rule 
departments and agencies the authority 
to enforce compliance directly against 
IRBs that are not operated by an FWA- 
holding institution (sometimes referred 
to as “independent IRBs”’). Under the 
pre-2018 rule, even if an institution 
engaged in research relied on an IRB 
operated by another FWA-holding 
institution, OHRP’s practice has been to 
enforce compliance through the engaged 
institution and not the reviewing IRB. 


Relatedly, another NPRM proposal 
would require single IRB review of 
multi-institution studies (see Section XII 
of this preamble). This proposal would 
place responsibility for meeting the 
relevant regulatory requirements on the 
IRB of record in a multi-institutional 
study, rather than on the institution 
engaged in the research. 
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3. Public Comments 


Approximately 50 comments 
addressed this proposal, largely in 
support, because it would encourage 
institutions to rely on IRBs not operated 
by an FWA-holding institution when 
necessary and would place 
responsibility on the IRB and its 
decisions rather than on the institution 
relying on the IRB’s determination. 
Commenters stated that this change 
could increase IRB accountability and 
protect institutions relying on IRBs that 
they do not operate. However, a few 
commenters supported the proposal 
only if the mandate for a single IRB of 
record in multi-institutional research 
was not implemented. That is, they 
supported the concept of holding IRBs 
not operated by the institution engaged 
in research accountable for compliance, 
but did not support it if it was intended 
solely to facilitate mandatory single IRB 
review for cooperative research, because 
they opposed that mandate. One 
organization that advocates for human 
subjects protections opposed the 
proposal because it did not believe that 
any research should be reviewed by an 
independent IRB, and feared this 
practice would become more frequent 
with this change. Several academic 
institutions opposed the proposal, as 
did a large trade organization, stating 
that this extension of the rule was not 
necessary. 


4. Response to Comments and 
Explanation of the Final Rule: Authority 
To Enforce Compliance Directly Against 
IRBs Not Operated by an FWA-Holding 
Institution 


New language at § _—_—.1011(a) is 
adopted that gives Common Rule 
departments and agencies the authority 
to enforce compliance directly against 
IRBs that are not operated by an assured 
institution. This authority will allow 
Common Rule departments and 
agencies to avoid involving other 
engaged institutions in enforcement 
activities related to the responsibilities 
of the designated IRB. It is anticipated 
that this change will reassure 
institutions using an IRB that they do 
not operate because compliance actions 
could be taken directly against the IRB 
responsible for the regulatory 
noncompliance, rather than against the 
institutions that relied on that review. 


B. Coverage of Clinical Trials 
1. Background and Pre-2018 
Requirements 


The Common Rule has historically 
applied to human subjects research that 
is conducted or supported by a Common 
Rule department or agency. Research 


that is not federally conducted or 
supported has not been subject to the 
Common Rule’s requirements unless the 
U.S. institution receiving federal 
funding for research voluntarily 
extended the Common Rule to all 
research conducted at that institution, 
regardless of funding source. 

The Institute of Medicine,?5 the 
National Bioethics Advisory 
Commission,?6 and others have stated 
that human subjects would be best 
protected by applying consistent ethical 
standards and a uniform system of 
regulatory oversight to all human 
subjects research conducted in the 
United States. Common Rule 
departments and agencies do not have 
statutory authority to directly apply the 
Common Rule to all human subjects 
research conducted in the United States. 
However, departments and agencies can 
require U.S. institutions that receive 
some federal funding from a Common 
Rule department or agency for research 
with human subjects to extend 
regulatory protections to all research 
studies conducted at the institution as a 
condition of funding. The 2011 ANPRM 
sought comment on this approach. 


2. NPRM Proposal 


The NPRM proposed changes in the 
regulatory language to extend the rule to 
all clinical trials, irrespective of funding 
source, that met three conditions: (1) 
The clinical trials are conducted at an 
institution that receives support from a 
federal department or agency for human 
subjects research that was not proposed 
to be excluded under the NPRM and 
was not exempt; (2) the clinical trials 
are not subject to FDA regulation; and 
(3) the clinical trials are conducted at an 
institution located within the United 
States. 

The purpose of the proposed clinical 
trials extension was to ensure that 
clinical trials involving significant risks 
that would otherwise not be covered be 
subject to federal oversight. It was for 
that reason that the proposed extension 
excluded clinical trials subject to FDA 
oversight. The proposed extension also 
was based on whether an institution 
received funding specifically for other 
human subjects research that had to 
comply with the substantive 
requirements of the Common Rule. The 
Common Rule departments and 
agencies have a more substantial 
relationship with institutions that 


15 Federman DD, Hanna KE, Rodriguez LL, eds. 
Responsible Research: A Systems Approach to 
Protecting Research Participants. Washington, DC: 
National Academies Press; 2002. 

16 National Bioethics Advisory Commission. 
Ethical and Policy Issues in Research Involving 
Human Participants. Bethesda, MD; 2001. 


receive federal support to conduct 
research subject to the regulatory 
requirements than they do with 
institutions that receive such support 
for only exempt human subjects 
research. 

The NPRM proposed that a clinical 
trial be defined as a research study in 
which one or more human subjects are 
prospectively assigned to one or more 
interventions (which may include 
placebo or other control) to evaluate the 
effects of the interventions on 
biomedical or behavioral health-related 
outcomes. By the term ‘“‘behavioral 
health-related outcomes,” the NPRM 
recognized that clinical trials may occur 
outside of the biomedical context, and 
further stated that the studies addressed 
in the proposed definition of clinical 
trial are more likely to present more 
than minimal risk to subjects, and, 
therefore, require the highest level of 
oversight. 


3. Public Comments 


Approximately 70 comments 
discussed the proposal to extend the 
Common Rule to cover certain clinical 
trials. Opinion was mixed, with a slim 
majority opposing the proposed change. 
Universities and medical centers 
providing comments largely opposed 
the proposed measure, while 
professional associations and advocacy 
groups largely supported the proposal. 
We note that some of those who 
opposed the clinical trial extension did 
so because they felt that the proposal 
did not go far enough to include 
additional types of research. 

Those supporting the proposed 
change indicated that it had the 
potential to ensure greater consistency 
of rules and protections for research 
subjects, thereby aiding efficiency and 
speeding the review process of study 
protocols. However, even those 
commenters who supported the 
proposal indicated that such an 
extension must fulfill the intent of a 
risk-based, streamlined approach to 
human subject protection, considering 
the effects of this extension on certain 
minimal risk research activities, such as 
student research, and social, behavioral, 
and educational research. 

Those expressing opposition to this 
expansion of coverage noted concerns 
that: (1) Because the research 
institutions likely to engage in clinical 
trials already require IRB review of such 
research, the expansion would only 
increase administrative burdens (such 
as federal reporting requirements) for 
this type of research without a 
meaningful increase in protections to 
human subjects; (2) the regulatory 
extension to nonfederally funded 
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clinical trials would encompass many 
minimal-risk social and behavioral 
research activities and currently 
unregulated institutional activities that 
involve randomization (such as 
nonfederally funded quality 
improvement or quality assurance 
activities); and (3) because an 
institution’s funding status may change, 
implementation of this proposal would 
be complicated. Several commenters 
expressed concern about the lack of 
detail in the NPRM regarding the 
planned implementation of the 
proposed requirement. 

Several commenters also expressed 
concern that the unfunded clinical trials 
encompassed by this proposal would be 
subject to the single IRB mandate 
without a corresponding provision of 
federal funds to implement that 
requirement. 

Some commenters suggested that the 
proposed change in the NPRM will not 
address the real gap in human subjects 
protections—facilities that receive no 
federal funding—and that if broad 
concern exists that some subjects are not 
being adequately protected in research 
that is not federally funded, then 
Congress would be the appropriate body 
to address any such deficiency through 
legislation. Further, some commenters 
expressed concern that extending the 
Common Rule to nonfederally funded 
clinical trials might have an overall 
effect of decreasing human subject 
protections by discouraging some 
smaller organizations from accepting 
any federal funding, thus removing 
federal oversight of their work. 

One research institution noted that, if 
finalized, the proposed clinical trials 
extension would be implemented at the 
same time the ability of institutions to 
formally extend the application of the 
rule to all research conducted at the 
institution is being eliminated. Some 
states, such as Virginia, have state 
human subjects regulations that must be 
applied to research when federal 
regulations are not required. The 
commenter noted that removing the 
option to voluntarily extend the FWA 
would have the effect of reducing 
uniform application of the federal 
standards, as nonfederally funded 
research that does not meet the 
proposed definition of a clinical trial 
would by default be subject to state law. 

A few commenters challenged 
whether the legal authority provided by 
the Public Health Service Act was 
sufficient to extend the Common Rule to 
nonfederally funded clinical trials. 
Commenters also suggested that this 
proposal is an unfunded mandate from 
the Federal Government with no benefit 


accruing to subjects or the research 
enterprise. 


4. Response to Comments and 
Explanation of the Final Rule: Coverage 
of Certain Clinical Trials 


The final rule does not adopt the 
NPRM proposal. Although we continue 
to maintain the position that increased 
harmonization of appropriate standards 
for ethical oversight of human subjects 
research is an important and desirable 
endpoint, we agree with the concerns 
expressed by commenters suggesting 
that our proposal for extending the 
Common Rule to currently unregulated 
clinical trials would benefit from further 
deliberation. Some commenters asserted 
that, in our attempt to close the 
perceived “gap” in oversight, the NPRM 
created a structure that would be both 
confusing and complicated for 
institutions to implement. We received 
multiple comments objecting to the 
administrative complexity involved in 
applying a regulatory extension 
triggered by the receipt of Common Rule 
department or agency funding for other 
nonexempt research, and asserting that 
the administrative burden is not offset 
by a corresponding increase in the 
meaningful protection of human 
subjects. Additionally, it is apparent 
from the public comments received that 
our intention to apply the Common Rule 
to cover the most risky types of 
research—clinical trials—was not 
accomplished through the NPRM 
proposal, given the definition of 
“clinical trial” included in the NPRM, 
as that definition encompassed research 
that would pose no more than minimal 
risk to subjects. Commenters were 
further concerned that an unintended 
consequence might be that the proposed 
extension would apply to low-risk 
student research and social, behavioral, 
or educational research, and would 
cause currently unregulated 
institutional activities, such as certain 
quality improvement or quality 
assurance activities, to fall within 
regulatory oversight. Upon reflection on 
the perspectives expressed by these 
commenters, we are persuaded that the 
proposed extension of the Common 
Rule is not appropriate to include in a 
final rule at this time. We will continue 
to carefully consider the related issues. 

As an alternative, we contemplated 
explicitly limiting the extension of this 
policy to clinical trials that present 
greater than minimal risk to subjects in 
order to better align with the intent of 
this extension, as described in the 
preamble to the NPRM. However, such 
an alteration of the rule would itself 
introduce a variety of complexities, 
including the question of how a 


determination would be made that a 
particular activity involves more than 
minimal risk. Thus, there would be a 
very real possibility that such a rule 
would lead to an administrative burden 
on substantially more activities than the 
rule itself would be targeting (such as 
many minimal risk quality improvement 
activities). 

We also considered the alternative of 
maintaining the pre-2018 standard of 
allowing institutions to voluntarily 
extend their FWAs to nonfederally 
funded research. We concluded that this 
alternative would not further the 
expressed goal of increasing the 
application of consistent protections to 
clinical trials, regardless of the source of 
support, because the extension of the 
FWA would be optional. We therefore 
plan to implement the proposed 
nonregulatory change to the assurance 
mechanism to eliminate the voluntary 
extension of the FWA to nonfederally 
funded research. 

We note the concern expressed by 
commenters that a gap in federal 
oversight will remain for nonfederally 
funded research, and the comment that 
Congress would be the appropriate body 
to address any such deficiency through 
legislation. We recognize that 
institutions may choose to establish an 
institutional policy that would require 
IRB review of research that is not 
funded by a Common Rule department 
or agency (and indeed, as commenters 
noted, almost all institutions already do 
this), and nothing in this final rule 
precludes institutions from providing 
protections to human subjects in this 
way. As a result, the final rule continues 
to allow institutions the same wide 
degree of flexibility that they currently 
have with regard to making other 
similar determinations regarding ethical 
oversight of research not regulated by 
the Common Rule. 

Although we are not implementing 
the proposed extension of the Common 
Rule to “clinical trials” (as defined by 
this policy), the proposed definition of 
“clinical trial”’ is still relevant to the 
final rule provision requiring posting of 
one IRB-approved consent form used to 
enroll subjects for a clinical trial 
conducted or supported by a federal 
department or agency, at§ ——_—.116(h). 
The definition of clinical trial is 
unaltered from the NPRM proposal and 
appears at§ —_.102(b). 


C. Activities Deemed Not To Be 
Research Appearat§ _.102(1) and 
Research Exempt From This Policy 
Appearsat§ _.104 


In response to the public comments, 
the NPRM’s general approach of 
designating various categories of 
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activities as excluded is not included in 
the final rule. The final rule reverts to 
the general structure of the pre-2018 
rule and integrates some of the 
categories proposed for exclusion in the 
NPRM into that structure. Some changes 
to the categories are also included in the 
final rule. 

In the final rule, some of the proposed 
exclusions from the requirements of the 
Common Rule are addressed in the 
definition of research, which includes a 
provision identifying “activities that are 
deemed not to be research”’ (see Section 
III). In addition, some of the proposed 
exclusions are included as exemptions 
in the final rule. Under § _.101(b) of 
the pre-2018 rule, six categories of 
research were considered exempt from 
this policy unless otherwise required by 
department or agency heads. In the final 
rule, exempt research is now described 
at§ _.104 and eight categories are 
included (see Section V). 


D. Department or Agency Discretion in 
Applying the Policy (§ .101(c), (d), 
(i)) 

1. Background and Pre-2018 
Requirements 


The pre-2018 requirements included 
provisions at § —_.101 that allowed 
federal department or agency heads to 
determine which specific activities or 
classes of activities are covered by the 
rule and whether certain requirements 
could be waived. This flexibility was 
allowed in recognition of the varying 
missions of the federal departments and 
agencies, the possibility that there may 
be superseding or alternative statutes or 
regulations governing their activities, 
and the possibility that a given situation 
requires either more stringent oversight 
(e.g., “sensitive research’’) or reduced 
requirements (e.g., a public health 
emergency). 


2. NPRM Proposals 


The NPRM proposed to retain the 
Common Rule’s pre-2018 requirement 
that federal department or agency heads 
retain final judgment about the coverage 
of particular research activities under 
the Common Rule (§__—.101(c)) and 
proposed an additional requirement that 
federal department or agency heads 
exercise their authority consistent with 
the principles of the Belmont Report. 

The NPRM also proposed at 
§ __.101(d) that a department or 
agency may require additional 
protections for specific types of research 
it supports or conducts, or that is 
otherwise subject to regulation by the 
federal department or agency but not 
otherwise covered by the Common Rule. 
However, advance public notice would 


be required when those additional 
requirements apply to entities outside of 
the federal department or agency itself. 
This latter requirement was intended to 
promote harmonization among federal 
agencies or departments, to the extent 
possible, and to ensure transparency 
between funding entities and the 
regulated community. 

Finally, at§_——_—.101(i) the NPRM 
proposed to amend the criteria for a 
department or agency waiving the 
applicability of some or all of the 
provisions of the policy, by stating that 
the alternative procedures to be 
followed must be consistent with the 
principles of the Belmont Report. The 
addition of this provision was to make 
explicit the ethical basis underpinning 
how waiver decisions have and must be 
considered. The NPRM also proposed 
that such waivers be posted on a 
publicly accessible federal Web site. 


3. Public Comments 


Approximately 25 comments related 
to the NPRM proposals at §_ _.101(c) 
and (i) andnoneon§ _.101(d). 
Comments received on these proposals 
generally expressed opposition to ever 
granting the authority to department or 
agency heads to retain final judgment as 
to whether a particular activity is 
covered by this policy, or to waive 
certain requirements, even though these 
provisions existed in the pre-2018 rule. 
These commenters were concerned 
about the potential for Common Rule 
departments and agencies to exclude 
certain activities for political purposes 
or for expediency, such as certain 
activities that might involve 
surveillance or criminal investigative 
aims. With regard to § .101(i), some 
commenters stated that reference to the 
ethical principles of the Belmont Report 
was too narrow. That is, one might rely 
on additional ethical considerations to 
evaluate the applicability of the 
regulations. 





4. Response to Public Comments and 
Explanation of the Final Rule: 
Department or Agency Discretion About 
Applicability of the Policy 


The final rule adopts the NPRM 
proposalsin§ _.101(c). Thus, under 
§ _.101(c), department or agency 
heads retain final judgment as to 
whether a particular activity is covered 
by the Common Rule, and this judgment 
should be exercised consistent with the 
ethical principles of the Belmont Report. 
We note that under the pre-2018 
requirements Common Rule 
departments and agencies retained final 
authority as to whether a particular 
human subjects research study 
conducted or supported by that 


department or agency is covered by the 
Common Rule (§__.101(c)) and that 
authority continues under the final 
regulations, but with the new limitation 
that this judgment must be consistent 
with the ethical principles of the 
Belmont Report. This discretion 
provides important flexibility given the 
varying missions and policies of the 
many departments and agencies. 

Although some commenters were 
opposed to ever granting departments or 
agencies the authority permitted by 
§ .101(c), we believe requiring that 
these decisions be consistent with the 
principles of the Belmont Report is an 
approach that promotes accountability 
while still giving federal departments 
and agencies the necessary flexibility to 
achieve their respective missions. 

The final rule in § _.101(d) does 
not adopt the NPRM proposals, and 
instead retains the pre-2018 language. 
The NPRM proposed to modify 
§ .101(d) to say that department or 
agency heads could require additional 
protections to research activities 
conducted or supported by federal 
departments or agencies, but that were 
not otherwise covered by the Common 
Rule. This language was intended as a 
clarification to the pre-2018 language. 
However, we determined that the term 
“additional protections” could 
potentially be confusing in that the 
activities at issue in this provision are 
those for which no Common Rule 
protections are required; thus the 
protections imposed by department or 
agency heads might be the only 
protections to which these activities are 
subject. We also note that departments 
or agencies conducting or supporting an 
activity subject to the Common Rule 
may require additional protections for 
human subjects. 

The final rule also does not 
incorporate the NPRM proposal in 
§ _.101(d) that advance public notice 
must be provided when a department or 
agency head requires that the Common 
Rule, or part of it, be applied to research 
activities not otherwise subject to the 
rule. Upon further assessment, we 
decided that such a requirement could 
hinder the ability of a department or 
agency to move quickly in cases where 
the department or agency determined 
that additional protections are 
warranted. 

Section _.101(i) of the final rule 
adopts a majority of the NPRM 
proposals. As proposed in the NPRM, 

§ .101(i) is modified to require that 
any alternative procedures adopted by 
departments or agency heads are 
consistent with the principles of the 
Belmont Report. Also as proposed in the 
NPRM, §__.101(i) is modified to state 
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that, unless otherwise required by 
statute or executive order, notice of 
these alternative procedures must be 
forwarded to OHRP (or any successor 
office), or to the equivalent office within 
the appropriate federal department or 
agency. The pre-2018 rule only listed 
OHRP (or any successor office) as the 
office to which notices must be sent. 
This final rule modification is intended 
to ensure that if a non-HHS department 
or agency allows for alternative 
procedures, the appropriate office 
within that same department or agency 
receives notification. The final rule 
retains the pre-2018 requirement for the 
notice to also be published in the 
Federal Register or in such other 
manner provided for in department or 
agency procedures. 


The final rule also adopts in 
§ _.101(i) the NPRM proposal to 
require that the waiver notice include a 
statement that identifies the conditions 
under which the waiver will be applied 
and a justification as to why the waiver 
is appropriate for the research, 
including how the decision is consistent 
with the principles in the Belmont 
Report. 


Section _.101(i) of the final rule 
does not include the NPRM proposal 
that would have required each federal 
department or agency conducting or 
supporting the research to establish on 
a publicly accessible federal Web site a 
list of the research for which a waiver 
has been issued. We decided that the 
rule’s requirement to publish the waiver 
notice in the Federal Register, or in 
such other manner as provided in 
department or agency procedures, 
adequately ensures that the waiver 
notice will be available to the public 
without also requiring that such notices 
be listed on a federal Web site. We note 
that some departments, such as HHS, 
currently post such notices on their Web 
sites. 


The final rule thus formally codifies 
in§ _.101(c) and (i) the general 
practice that the ethical standards 
articulated in the Belmont Report are 
the ethical standards that Common Rule 
departments or agencies will use in 
determining whether an activity is 
covered under this policy or whether to 
grant a waiver of the applicability of 
some or all of the provisions (unless 
otherwise required by law). The 
addition of the reference to the Belmont 
Report makes explicit the ethical basis 
underpinning how waiver decisions 
have and must be considered. 


E. State and Local Laws That Provide 
Additional Protections for Human 
Subjects (§ .101(f)) 


1. Background and Pre-2018 
Requirements 


The pre-2018 rule specified that the 
policy does not affect any state or local 
laws or regulations that may otherwise 
be applicable and that provide 
additional protections for human 
subjects. The NPRM did not propose 
any changes to this statement. However, 
questions raised by public comments, as 
described below, led to some 
clarifications to the final rule. 


1. Public Comments 


Several public comments raised 
questions and concerns about the ability 
of tribal nations to require additional 
protections that might be needed for 
research involving American Indian/ 
Alaska Native (AI/AN) populations. 

One tribal government noted the 
documented mistrust of research by AI/ 
AN people and communities, and 
advocated for specific provisions 
acknowledging the authority and role of 
tribal nations in overseeing research that 
happens on their lands and with their 
citizens. Additionally, this entity noted 
that tribal nations do not always have 
their own regulatory bodies for human 
subject research protections, expressing 
concern about external groups deciding 
what constitute risks and benefits for 
the community. 


Other AI/AN Population concerns of 
commenters included: 


e Tribal (i.e., group) and individual 
consent for secondary research with 
biospecimens: Commenters noted that 
group consent can occur and should 
inform the proposed changes in the rule. 
They also noted that broad consent for 
future, unspecified research use of 
biospecimens presents a challenge to 
the ongoing ability of both tribes and 
individuals to choose to remove their 
data from research, or to understand 
how their information is being used to 
benefit, or put at risk, themselves or 
others. 

e Tribal and individual consent for 
research with biospecimens or other 
data from people who are no longer 
alive: AI/AN groups noted the need to 
address protections for biospecimens 
initially collected from living humans 
after those humans pass away. 

e Research oversight by tribal IRBs 
and other tribal regulatory bodies: Al/ 
AN groups raised concerns about the 
use of a single IRB in cooperative and 
multi-institutional research, which does 
not foster community-based governance 
and oversight of research that has the 


potential to improve outcomes for tribal 
and minority populations. 


e Research oversight for categories of 
research and activities important in 
tribal contexts: Commenters noted 
concerns about the proposed changes 
related to the exclusion of certain 
categories of activities (e.g., oral history, 
biography), addition of exempt 
categories of research (e.g., educational 
tests, surveys, interviews), and 
elimination of continuing review 
requirements for some studies because 
tribal research review often extends the 
scope of examination beyond 
individual-level protections to enact 
community-level protections important 
for maintaining the integrity of 
culturally significant information and 
practices. Changes to excluded and 
exempt categories of research and 
eliminating some continuing review 
requirements, especially where no clear 
mechanism for additional tribal 
oversight and input has been 
established, are a cause for concern for 
the AI/AN community. 


2. Response to Public Comments and 
Explanation of the Final Rule: State and 
Local Laws That Provide Additional 
Protections 


Consistent with the pre-2018 rule, this 
final rule retains the language in 
§ _.101(f)) providing that the 
Common Rule does not affect any state 
or local laws or regulations that may 
otherwise be applicable and that 
provide additional protections for 
human subjects. However, the final rule 
adds clarifying language providing that 
the referenced state or local laws or 
regulations include tribal laws passed 
by the official governing body of an AI/ 
AN tribe. Thus, if the official governing 
body of a tribe passes a tribal law that 
provides additional protections for 
human subjects, the Common Rule does 
not affect or alter the applicability of 
such tribal law. (Note that a similar 
change was alsomadeto§ _.116(i) 
and (j) to provide the same 
clarification.) In addition, for purposes 
of the exception to the single IRB review 
requirement for cooperative research, 
relating to circumstances where review 
by more than a single IRB is required by 
law, § _.114(b)(2)(i) specifies that 
tribal law is to be considered in 
assessing whether more than single IRB 
review is required by law. 
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F. Research Covered by This Policy 
Conducted in Foreign Countries 


(§__.101(h)) 


1. Background and Pre-2018 
Requirements 


The pre-2018 requirements at 
§ _.101(h) stated that when research 
covered by this policy takes place in 
foreign countries, procedures normally 
followed in those countries to protect 
human subjects may differ from those 
set forth in this policy. The previous 
rule cited the Declaration of Helsinki, as 
amended in 1989, as an example of 
internationally recognized ethical 
standards that a foreign country might 
use as its ethical standard. The rule 
provided that if a department or agency 
head determined that procedures 
prescribed by the institution in the 
foreign country afforded protections that 
are at least equivalent to those provided 
in this policy, the department or agency 
head may approve the substitution of 
the foreign procedures in lieu of the 
procedural requirements provided in 
this policy. 


2. NPRM Proposal 


The NPRM proposed to remove the 
specific reference to the Declaration of 
Helsinki in this provision. A concern 
with providing a specific example of an 
internationally recognized ethical 
document is that such a document is 
subject to change independent of 
Common Rule departments and 
agencies, and therefore could be 
modified to contain provisions that are 
inconsistent with future U.S. laws and 
regulations. 


3. Public Comments 


A few comments addressed the 
removal of the reference to the 
Declaration of Helsinki. These 
comments were equally divided 
between those opposed and those 
supportive or generally supportive. 
Those opposed feared that the removal 
of the reference would suggest that the 
Declaration of Helsinki does not apply 
and that it was cited in the pre-2018 
requirements as an example, not as an 
equivalent replacement for the Common 
Rule. These commenters also noted that 
the United States had refused to sign on 
to some recent revisions to the 
Declaration. One organization 
commented that it would have been 
useful for the NPRM to address the issue 
of equivalent protections for U.S.- 
funded research conducted in foreign 
countries, as that might have addressed 
ongoing concerns about the use of 
alternative systems of protections when 
research is conducted outside the 
United States. Those supportive of 


removing the reference to the 
Declaration of Helsinki agreed with the 
arguments laid out in the NPRM and felt 
that it was judicious to not align U.S. 
regulations with other standards 
because those standards are likely to 
change, perhaps in ways inconsistent 
with U.S. policy. 


4. Response to Public Comments and 
Explanation of Final Rule: Removing the 
Reference to the Declaration of Helsinki 


The final rule adopts the NPRM 
proposal. Although the pre-2018 
requirements cited the Declaration of 
Helsinki as an example of 
internationally recognized ethical 
standards that a foreign country might 
use as its ethical base, we note that 
providing a specific example of an 
internationally recognized ethical 
document is concerning because such a 
document is subject to change 
independent of Common Rule 
department or agency policies, and 
therefore might be modified in ways 
that create standards that are 
inconsistent with U.S. laws and 
regulations. 


G. Harmonization of Department and 
Agency Guidance (§ .101(j}) 


1. Background and Pre-2018 
Requirements 


Each Common Rule department and 
agency and the Food and Drug 
Administration (FDA) are authorized to 
issue its own guidance with regard to 
interpreting and implementing the 
regulations protecting human subjects. 
That guidance may differ substantially 
across entities. Currently, multiple 
efforts are underway to address 
variation in guidance across the Federal 
Government, but no regulatory 
requirement exists for departments and 
agencies to consult with other 
departments before issuing a policy, to 
the extent appropriate. As a result, 
interdepartmental communication has 
been at times uneven, leading to 
potentially avoidable inconsistencies. 
The Common Rule departments and 
agencies have procedures for sharing 
proposed guidance before it is adopted, 
and these procedures have generally 
been successful. Additionally, FDA and 
OHRP have worked closely to ensure 
harmonization of guidance to the extent 
possible, given the differing statutory 
authorities and regulatory missions. 
Also, as mentioned earlier in section 
I.B., the 21st Century Cures Act was 
enacted in December 2016. Among other 
things, it requires that the Secretary of 
HHS, to the extent practicable and 
consistent with other statutory 
provisions, harmonize the differences 


between 45 CFR part 46, subpart A, and 
FDA’s human subject regulations. 


2. NPRM Proposal 


Responses to questions in the 2011 
ANPRM about the need for 
harmonization of guidance across 
Common Rule departments and 
agencies reflected widespread support 
for such efforts. Several commenters 
acknowledged the difficulty of getting 
all Common Rule departments and 
agencies to agree on all issues, as each 
has a different mission and research 
portfolio. However, they encouraged 
seeking harmonized guidance whenever 
possible. Thus the NPRM proposed that 
the regulations contain language 
requiring consultation among the 
Common Rule departments and 
agencies for the purpose of 
harmonization of guidance, to the extent 
appropriate, before guidance on the 
Common Rule is issued, unless such 
consultation is not feasible. The NPRM 
requested public comment on whether 
the proposed language would be 
effective in achieving greater 
harmonization of department and 
agency guidance, and if not, how it 
should be modified. 


3. Public Comments 


Approximately 60 comments were 
received regarding this proposal, and 
they were almost equally divided for 
and against it, although some of those 
opposed thought it did not go far 
enough to achieve the intended goal. 
Those who supported the proposal, 
either fully or partially, cited concerns 
they have as institutions, investigators, 
or IRBs in navigating different sets of 
regulations and different department or 
agency guidance documents. As noted 
above, among those who opposed the 
proposal, some expressed concern that 
the proposed language about 
harmonization did not go far enough. 
That is, they thought the language 
should mandate harmonization in 
guidance across Common Rule 
departments and agencies. These 
commenters felt that without a 
requirement to harmonize, federal 
departments and agencies will continue 
with business as usual and policy and 
guidance will continue to differ, 
creating complexity in the research 
environment. For example, one large 
research university emphasized the 
importance of harmonization across 
federal departments and agencies 
regarding guidance on the protections of 
human subjects for investigators, IRB 
administrators, and human subjects, and 
felt that the proposed language in the 
Common Rule NPRM might be 
ineffective in harmonizing agency 
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guidance. Several commenters 
emphasized the need, in particular, for 
greater harmonization between the 
Common Rule and FDA requirements, 
and between the Common Rule and the 
requirements of the Health Insurance 
Portability and Accountability Act of 
1996 (HIPAA; Pub. L. 104-191). 


Others were concerned that this 
provision would, in effect, mean that 
Common Rule departments and 
agencies issue fewer guidance 
documents because of lengthy internal 
government review and approval 
processes. 


4. Response to Public Comments and 
Explanation of the Final Rule: 
Harmonization of Guidance 


We believe there is a compelling case 
for as much consistency as is possible 
regarding guidance on the protections of 
human subjects. As such, the final rule 
implements the NPRM proposal at 
§ _.101(j). The final rule creates a 
requirement that guidance should be 
issued only after consultation among the 
Common Rule departments and 
agencies, while also permitting 
guidance to be issued without such 
consultation when it is not feasible. The 
proposal recognizes that harmonization 
will not always be possible or desirable 
given the varied missions of the 
departments and agencies that oversee 
the protection of human subjects and 
differences in their statutory authorities. 


We note that some public comments 
expressed concern about the acceptable 
degree of variability among departments 
and agencies and encouraged attention 
to these concerns when diverging on 
guidance. The departments and agencies 
that oversee the protection of human 
subjects have a variety of missions and 
functions, including regulatory agencies 
and agencies that conduct and support 
research. In addition, in some cases, 
statutory differences among the 
departments and agencies have resulted 
in different regulatory requirements and 
guidance. They also oversee very 
different types and phases of research 
and thus may have reasonable 
justifications for differences in 
guidance. However, we agree that efforts 
should be made to issue collective 
guidance when possible and feasible 
and in a timely manner. We do not 
believe that this provision will result in 
the issuance of less guidance, because it 
largely codifies what has been the 
working practice among Common Rule 
departments and agencies up to this 
point. 


H. Compliance Dates and Transition 
Provisions of the Final Rule 


(§ .101(1)) 
1. NPRM Proposal 


In the NPRM, we shared the 
expectation that both the effective date 
of the final rule (meaning the date that 
the regulatory text is published in the 
Code of Federal Regulations) and the 
general compliance date of the final rule 
(meaning the date after which, as a 
general matter, regulated entities must 
comply with this rule) would be 1 year 
after publication of the final rule in the 
Federal Register. The NPRM also 
proposed two exceptions that would 
provide different compliance dates for 
two provisions. The first proposed 
exception pertained to the NPRM’s 
proposal that the Common Rule be 
extended to cover all biospecimens 
regardless of identifiability. The second 
proposed exception pertained to the 
NPRM ’s proposal that a single IRB 
would be responsible for certain multi- 
institutional clinical trials, also 
described as cooperative research. The 
NPRM proposed that both of these 
provisions would have compliance 
dates of 3 years after publication of the 
final rule in the Federal Register. The 
intent behind this proposed delay was 
to enable institutions to develop 
institutional policies and procedures 
necessary to implement these new 
requirements. The NPRM sought public 
comments about the advisability of this 
proposed approach as well as possible 
alternatives. 

The preamble to the NPRM also 
discussed the option for institutions or 
investigators to implement provisions of 
the final rule anticipated to provide 
additional regulatory flexibilities 
voluntarily 90 days after publication of 
the final rule in the Federal Register. 
This proposed approach was intended 
to enable institutions or investigators to 
gain the benefit of revisions to the 
Common Rule as soon as possible. The 
NPRM proposed a 90-day timeframe for 
this flexibility to enable the Common 
Rule departments and agencies time to 
develop the documents and tools 
needed to assist institutions in 
implementing the rule’s regulatory 
flexibilities (e.g., the Secretary’s broad 
consent templates) and the Secretary’s 
list of privacy safeguards. 

The NPRM also explained that the 
proposed extension of the Common 
Rule to clinical trials that are not 
directly funded by a Common Rule 
department or agency, but that are 
conducted at an institution that receives 
funding from a Common Rule 
department or agency for other human 
subjects research, would not apply to an 


institution until the institution had 
received federal funding for nonexempt 
research in an award made after the 
effective date of the final rule. 

The NPRM also proposed that 
ongoing human subjects research 
initiated before the effective date of the 
final rule would not need to comply 
with particular regulatory requirements. 

In addition, the NPRM proposed a 
grandfather clause for research 
involving the use of biospecimens 
collected before the compliance date. 
This clause applied to the provision that 
would extend the Common Rule to 
cover all biospecimens, regardless of 
identifiability. Specifically, the NPRM 
proposed that such research would not 
need to comply with the final rule if any 
research uses of the biospecimens 
occurred only after removal of any 
individually identifiable information. 


2. Public Comments 


A majority of comments received on 
the effective dates opposed the NPRM’s 
proposal that only nonidentified 
biospecimens would be grandfathered. 
Others commented on the proposed 3- 
year compliance date for the proposed 
expansion of the definition of human 
subjects to all biospecimens, regardless 
of their identifiability. In Section III, we 
discuss the determination not to finalize 
the biospecimen provisions, which 
addresses these comments. Some 
commenters expressed support for the 
general compliance date, as well as the 
delayed compliance date for the 
cooperative research provision. 

Many commenters expressed the 
viewpoint that regulated entities would 
need to invest significant time and 
resources before they would be able to 
comply with the changes to the 
Common Rule proposed in the NPRM. 
Some commenters (including an 
academic institution and a hospital 
association) noted that such investments 
would have implications not only for 
research operations, but also for clinical 
care. Some commenters also noted their 
concern that 1 year was not enough time 
for institutions to comply with the large 
number of new and different regulatory 
requirements proposed in the NPRM 
and that such changes would necessitate 
significant modifications to their 
research and clinical enterprises and 
might impose hardships on IRBs, IRB 
staff, institutional leadership, and the 
regulated research community. Several 
commenters explained that the 
proposed 1-year general compliance 
period would not provide enough time 
to update written IRB procedures 
(which are required under the Common 
Rule), disseminate such procedures, 
update related documents (e.g., forms), 
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and develop appropriate training 
materials. One of these commenters 
explained that accredited institutions 
will need time for accrediting bodies to 
align their accreditation standards with 
the revised regulatory standards or risk 
conflicts between meeting proposed 
regulatory standards and losing 
accreditations. 

Other commenters recommended 2- 
year or 3-year general compliance dates 
(including some that recommended 
permitting institutions to comply 
earlier), noting that compliance would 
be particularly challenging for 
institutions with smaller research 
programs. At least one commenter 
argued that the 3-year compliance date 
for the proposed cooperative research 
provision was inadequate given the 
significant costs and time that would be 
associated with establishing reliance 
agreements between collaborating 
research sites, maintaining required 
documents at the reviewing IRB, and 
ensuring that applicable laws were 
followed. At least one commenter 
argued that the proposed effective and 
compliance provisions left institutions 
with the discretion to remove studies 
from the oversight of the Common Rule 
without establishing any protective 
standards for doing so. 

One group representing multiple 
professional societies stated that the 
efficiencies achieved by eliminating 
protracted negotiations concerning 
consent forms and institutional 
responsibilities will far outweigh any 
upfront costs incurred through 
implementation of this policy, and 
advocated for a faster timeframe for 
compliance than the proposed 3 years 
from the time of final publication: 1 year 
for clinical trials and 2 years for 
research studies. Another commenter 
echoed these views. 

We did not receive many comments 
concerning the proposal to allow 
institutions to implement provisions 
offering regulatory flexibilities before 
the compliance date. 


3. Response to Comments and 
Explanation of the Final Rule: 
Compliance Dates and Transition 
Provisions 


The effective date and compliance 
dates included in this final rule are 
intended to meet the same general 
objectives as those described in the 
NPRM. Nonetheless, the approach 
adopted in the final rule is different in 
certain respects from the approach 
proposed in the NPRM. 

As a general matter, none of the 
proposed dates in the NPRM related to 
research with biospecimens will be 
implemented because the proposal 


included to extend the Common Rule to 
research with all biospecimens, 
regardless of identifiability, is not being 
implemented. 

The final rule adopts an effective date 
and a general compliance date of 1 year 
from publication of this final rule in the 
Federal Register. During this 1-year 
timeframe, institutions will be able to 
revise forms, documents, and practices 
for consistency with the revisions 
reflected in this regulation. Although we 
recognize the work associated with 
compliance, we concluded that 1 year is 
a reasonable and adequate timeframe. 
We note that ongoing research studies 
that were initially approved by an IRB, 
waived pursuant to § _—.101(i), or 
determined to be exempt before January 
19, 2018 will not be required to comply 
with the changes reflected in this final 
tule. 

Section 101(1) describes the regulatory 
requirements that will apply to specific 
categories of research once the final rule 
goes into effect. For clarity,§ —_.101(I) 
begins by defining two sets of 
requirements. First, as set forth in 
§ _.101(1)(1), the pre-2018 rule is 
described as the “‘pre-2018 
Requirements”’, which refers to the 
Common Rule as published in the 2016 
edition of the Code of Federal 
Regulations. As described below, certain 
ongoing research may be subject to these 
requirements. 

Section 101(1)(3)-(4) describes the 
different regulatory requirements that 
apply to different categories of research. 
For clarity and in order to have an easy- 
to-implement standard, these categories 
are generally based upon the date the 
research was initially approved by an 
IRB, waived pursuant to§ _.101(i), or 
determined to be exempt. 

The first category of research, 
describedin § _.101(1)(3), applies to 
research initially approved by an IRB, 
waived pursuant to§ _.101{(i), or 
determined to be exempt before January 
19, 2018. We believe that such research 
(e.g., research for which an initial 
determination was made before the 
effective date of this final rule) should, 
as a general rule, be able to follow the 
same set of standards throughout the 
entire course of the research. The intent 
is to minimize burdens associated with 
research conducted over a period of 
time and to avoid a requirement that 
such research be subject to two sets of 
rules during the lifetime of the research. 
For that reason, this regulation adopts as 
a default rule, set forth in 


§ .101(1)(3), that research initially 
approved by an IRB, waived pursuant to 
§ .101(i), or determined to be 


exempted before January 19, 2018 (the 
effective date of this final rule) will not 


be subject to this final rule but will 
continue to be subject to the 
requirements of the Common Rule in 
place before January 19, 2018. 

However, we also recognize that 
institutions may prefer, for a particular 
study initiated before to January 19, 
2018, to comply with this final rule 
given the benefits that it offers and for 
administrative simplicity such as 
common regulatory requirements across 
an institution. Thus, § _.101(I)(3) 
permits institutions engaged in ongoing 
research that was initially approved by 
an IRB, waived pursuant to 
§ .101(i), or determined to be 
exempted before January 19, 2018, to 
choose, on a study-by-study basis, 
whether such research will be subject to 
the pre-2018 requirements (the rule in 
place before January 19, 2018, or the 
final rule. This is an exception and is 
offered as an additional flexibility to 
regulated entities. If an institution 
engaged in such research determines 
that it prefers to comply with the final 
rule for a particular research study, such 
research will be subject to the final rule 
if the institution formally makes a 
determination that the final rule will 
apply to such research and an IRB 
documents the decision made by the 
institution. If these requirements are not 
met or if the institution makes no 
decision, the pre-2018 requirements will 
apply to such research. 

The second category of research, 
described in § _.101(1)(4), applies to 
research initially approved by an IRB, 
waived pursuant to § _.101(i), or 
determined to be exempted on or after 
January 19, 2018. Because such research 
does not begin and is not conducted 
until after the general compliance date 
of this final rule, this category of 
research is subject to the final rule 
throughout its lifetime. 

A single IRB requirement for 
cooperative research has been adopted 
in§ _.114(b) of this final rule. As set 
forthin§ _.101(1)(2), this final rule 
adopts the proposed 3-year compliance 
date for this requirement to afford 
affected institutions sufficient time to 
prepare for and implement this 
requirement (e.g., developing 
institutional policies and procedures). 

Although we understand the concerns 
expressed concerning the complexities 
that will be involved in establishing 
reliance agreements to satisfy the 
cooperative research provision adopted 
in this final rule, this final rule reflects 
the conclusion that a 3-year compliance 
date is adequate for this provision, 
based on our belief that this provision 
will offer significant benefits to 
institutions, particularly as the 
regulated community becomes 
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accustomed to this requirement. In 
addition, we believe it is likely that the 
institutional policies, procedures, and 
standard documents needed to 
implement this regulatory provision 
will, over time, become increasingly 
standardized, which will significantly 
minimize the burden on institutions 
associated with this requirement. So 
long as all other regulatory requirements 
are satisfied, institutions may use a 
single IRB to oversee cooperative 
research even before this compliance 
date occurs with respect to any research 
that institutions believe may benefit 
from this approach. 

This final rule does not adopt the 
proposal mentioned in the preamble to 
the NPRM to permit institutions and 


investigators to voluntarily implement 
provisions in the final rule that allow 
additional flexibilities 90 days after 
publication of the final rule. We 
determined that the approach adopted 
at§ _.101(1)(3), and described above, 
offers institutions and investigators 
similar advantages with respect to the 
conduct of ongoing research, while 
providing greater clarity and more 
simplicity concerning which set of 
regulatory requirements apply to 
particular studies. 

We disagree with the comment that 
the proposed timelines enable 
institutions to remove their studies from 
the oversight of the Common Rule 
without establishing appropriate 
standards for doing so. The final rule 


does not enable institutions to opt out 
of compliance with the Common Rule. 
The effective dates do afford institutions 
the discretion to choose, on a study- 
specific basis whether existing research 
should comply with the Common Rule 
in place when the research was initiated 
(the pre-2018 requirements) or this final 
rule (the 2018 requirements). This 
flexibility is offered only for certain 
ongoing research studies that were 
initially approved, determined to be 
exempt, or subjecttoa§ _.101{(i) 
waiver before the effective date of this 
final rule. 

To explain the approach adopted in 
this final rule, the following chart 
describes the standards that apply to 
different categories of research: 





Research Study Initiation Date 


Standards 





Research initially approved by an IRB, waived pursuant to § .101(i), 
or determined to be exempt before January 19, 2018. 


Research initially approved by an IRB, waived pursuant to § .101(i), 
or determined to be exempt on or after January 19, 2018. 


lations). 





These studies are by default subject to the pre-2018 rule (the Common 
Rule as published in the 2016 edition of the Code of Federal Regu- 


However, an institution engaged in such research may choose to com- 
ply with the final rule (2018 requirements) for such a study if the in- 
stitution makes a determination to apply the final rule to the study 
and an IRB documents this determination. 

These studies are subject to the final rule (2018 requirements). 





I. Severability (§ .101(m)) 


A severability clause has been added 
as§ _.101(m), providing that if any 
provision of this final rule is held to be 
unenforceable in one set of 
circumstances, it should be construed to 
give maximum effect to the provision as 
applied to other persons or 
circumstances. Similarly, if a provision 
is held to be invalid or unenforceable, 
that provision should be severable from, 
and have no impact on the application 
of, the remainder of the rule. This 
provision reflects our intention 
regarding the way that this final rule, 
and the pre-2018 rule, should be 
construed and interpreted and is meant 
as a Clarification. 


III. Definitions for Purposes of this 
Policy (§ .102) 


The final rule revises and adds new 
definitions of key terms for the purposes 
of this policy, as summarized below. 
Some of the changes are made to clarify 
new provisions that appear elsewhere in 
the final rule. In addition, the 
definitions have been placed in 
alphabetical order to facilitate searching 
by the reader. The definitions of 
institution, IRB, and IRB approval are 
unchanged but appear in a different 
place in the regulatory language. 


A. Certification (§ __.102(a)) 


Although “certification” was defined 
in the pre-2018 requirements, as was 
proposed in the NPRM, the final rule 
clarifies that notification by the 
institution that a proposed research 
study has been reviewed and approved 
is made to the supporting ‘‘federal”’ 
department or agency and that it might 
be a component of the agency or 
department that is notified rather than 
the entity as a whole. This clarification 
relates to the change included in the 
final rule at § .102(d) regarding the 
definition of ‘‘federal department or 
agency” that clarifies that this phrase 
refers to the department or agency itself, 
not its bureaus, offices, or divisions. 
There were no public comments on this 
clarification. 


B. Clinical Trial (§ .102(b)) 


1. Background and Pre-2018 
Requirements 





The pre-2018 rule did not include a 
definition of “clinical trial.’’ 


2. NPRM Proposal 


The NPRM proposed defining 
“clinical trial,” for purposes of this 
policy, as a research study in which one 
or more human subjects are 
prospectively assigned to one or more 
interventions (which may include 
placebo or other control) to evaluate the 


effects of the interventions on 
biomedical or behavioral health-related 
outcomes. In addition, the NPRM 
requested public comment on whether 
the proposed definition should include 
additional explanation of what is 
encompassed by the term behavioral 
health-related outcomes. 


3. Public Comments 


Approximately 20 comments 
explicitly addressed the definition of 
“clinical trial” included in the NPRM. 
All expressed concern that the proposed 
definition encompassed more activities 
than intended, given the NPRM 
discussion that the definition was 
intended to cover the riskiest research. 
Commenters who responded asked for 
some type of clarification, either in 
guidance or in the regulatory language 
itself about the term “behavioral health- 
related outcomes.’’ One commenter 
noted that clinical trials involving 
activities such as behavioral 
interventions, psychotherapy, or skills 
training, for example, should be 
included in the proposed regulations of 
clinical trials in a risk-based manner, as 
for nonbehavioral studies. That is, 
greater oversight would be required for 
trials with a higher potential degree of 
risk, regardless of what type of trial. The 
commenter noted that certain 
populations for whom behavioral health 
research is conducted are high risk by 
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nature, such as chronically suicidal 
individuals. Another commenter asked 
that the regulatory language include 
additional explanation of what is 
encompassed by the term “‘behavioral 
health-related outcomes’’ because 
practitioners and researchers 
conceptualize the term differently. 


4. Response to Comments and 
Explanation of the Final Rule Definition 
of Clinical Trial 


The final rule at § ——_—.102(b) adopts 
the NPRM definition of ‘‘clinical trial,” 
which is a research study in which one 
or more human subjects are 
prospectively assigned to one or more 
interventions (which may include 
placebo or other control) to evaluate the 
effects of the interventions on 
biomedical or behavioral health-related 
outcomes. We generally expect that this 
definition will be applied harmoniously 
with the definition of clinical trial 
recently promulgated in the 
ClinicalTrials.gov final rule.17 


In response to public concerns about 
an overly expansive definition of 
“clinical trial’ given the importance of 
that definition to the proposed 
extension of the rule to clinical trials 
previously not covered by the rule, we 
have eliminated that proposed 
expansion of coverage in this final rule. 
As such, the definition that appears in 
the final rule will only be relevant to the 
requirement for posting of consent 
forms for clinical trials conducted or 
supported by Federal departments or 
agencies (§___—_—.116(h)). It should be 
appropriate for that relatively narrow 
regulatory purpose. 


C. Department or Agency Head and 
Federal Department or Agency/ 
Institutions (§ .102(c) (d) and (f)}) 


1. Background and Pre-2018 
Requirements 


The pre-2018 rule provided a 
definition of ‘department or agency 
head.” The phrase appeared repeatedly 
throughout the regulations. 


2. NPRM Proposals 


New definitions of ‘department or 
agency head” and “federal department 
or agency” were proposed in the NPRM 
to clarify requirements related to federal 
department and agency discretion in 
applying the policy to their funded or 
conducted research. 


17 HHS. Clinical Trials Registration and Results 
Information Submission. 81 FR 64981. (Sept. 21, 
2016). Retrieved from https:// 
www.federalregister.gov/documents/2016/09/21/ 
2016-22129/clinical-trials-registration-and-results- 
information-submission 


3. Public Comments 


There were no comments directly 
related to these proposed revisions. 


4. Explanation of the Final Rule: 
Definition of Department or Agency 
Head, Federal Department or Agency, 
and Institution 


The final rule adopts the NPRM 
proposals to provide new definitions of 
“department or agency head” and 
“federal department or agency,’’ which 
appearat§ —_.102(c) and (d). 
“Department or agency head” at 
§ _.102(c) refers to the head of any 
federal department or agency, for 
example, the Secretary of HHS, and any 
other officer or employee of any federal 
department or agency to whom 
authority has been delegated. To add 
clarity to the definition found in the 
pre-2018 regulations, the example of the 
Secretary of HHS was inserted. 

The final rule provides at 
§ _.102(d) a definition of “federal 
department or agency”’ in order to avoid 
confusion as to whether this phrase 
encompasses federal departments and 
agencies that do not follow the Common 
Rule. The definition also clarifies that 
this phrase refers to the department or 
agency itself, not its bureaus, offices, or 
divisions. This is consistent with the 
historical interpretation of the Common 
Rule. Related to this, the definition of 
“institution” was changed at 
§ _.102(f) in the final rule to clarify 
that departments can be considered 
institutions for the purposes of this 
policy. The final rule provides examples 
of what is intended by this definition: 
HHS, the Department of Defense, and 
the Central Intelligence Agency. 


D. Human Subject (§ .102(e)) 


1. Background and Pre-2018 
Requirements 


The pre-2018 rule defined “human 
subject” as a living individual about 
whom an investigator (whether 
professional or student) conducting 
research obtains (1) data through 
intervention or interaction with the 
individual, or (2) identifiable private 
information. Further, the pre-2018 rule 
asserted that “private information” was 
considered individually identifiable if 
the identity of the subject is or may 
readily be ascertained by the 
investigator or is associated with the 
information. 

Thus, in cases where no intervention 
or interaction with an individual 
occurred, determining the meaning of 
“identifiable” and ‘readily 
ascertainable”’ was central to 
determining whether human subjects 
were involved in a research activity 


covered by the pre-2018 rule. Under the 
pre-2018 rule, provided the data were 
collected for purposes other than the 
currently proposed research, it was 
permissible for investigators to conduct 
research on biospecimens and data that 
had been stripped of all identifiers or 
coded without obtaining consent 
because the nonidentified biospecimens 
and data did not meet the regulatory 
definition of a human subject. 

Moreover, ‘‘private information” was 
not considered to be identifiable under 
the pre-2018 rule if the identity of the 
subject is not or may not be “readily 
ascertained”’ by the investigator from 
the information or associated with the 
information. 

If the definition of “human subject” 
was met, together with the other 
significant requirements, the pre-2018 
rule required IRB review and approval 
unless the study was exempt. IRB 
waiver of informed consent was 
allowable under the Common Rule, if 
the research study satisfied the criteria 
for waiver of informed consent. 


2. NPRM Proposal 


The NPRM proposed to revise the 
definition of “human subject’ to 
include research in which an 
investigator obtains, uses, studies, or 
analyzes biospecimens, regardless of 
identifiability. Thus, the focus of this 
proposal was to require informed 
consent for research involving 
biospecimens in all but a limited 
number of circumstances. In addition, 
the NPRM proposal would have still 
permitted IRBs to waive the requirement 
for informed consent for research use of 
biospecimens, but the requirements for 
approval of such waivers would have 
been very strict, and such waivers 
would have occurred only in rare 
circumstances (see Section XIV on 
waiver of informed consent). This 
expansion of the definition of “human 
subject’”’ would also have triggered other 
provisions of the NPRM relating to the 
use of biospecimens, including security 
measures. Thus, it was a complex and 
far-reaching proposal. 

The NPRM also offered two 
alternative proposals to altering the 
definition of “human subject,” both of 
which maintained “identifiability” as a 
major aspect of determining 
applicability of the Common Rule to 
biospecimens. The public was asked to 
comment on which of the three 
proposals achieved the most reasonable 
tradeoff between the principles of 
autonomy and beneficence. 

Alternative Proposal A would have 
expanded the definition of “human 
subject’’ to include whole genome 
sequencing (WGS). Under this 
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alternative, WGS would have been 
considered to be the sequencing of a 
human germline or somatic 
biospecimen with the intent to generate 
the genome or exome sequence of that 
biospecimen. 

Alternative Proposal B would have 
expanded the definition of “human 
subject’’ to include the research use of 
information that was produced using a 
technology applied to a biospecimen 
that generated information unique to an 
individual. In such a case, it was 
foreseeable that, when used in 
combination with publicly available 
information, the individual could have 
been identified. Information that met 
this standard would have been referred 
to as “‘bio-unique information.” 

The NPRM also asked the public to 
comment on whether the rule should 
include a definition of ‘“‘biospecimen”’ 
and whether the rule should be clearer 
and more direct about the definition of 
“identifiable private information.” 

The NPRM also proposed some minor 
changes to the wording of the definition 
of “human subject” merely to clarify 
how the word “‘obtains’’ has been 
interpreted. 

The NPRM did not propose any major 
substantive modifications to the 
descriptions of “private information” 
and “identifiable private information” 
found in the pre-2018 rule. However, 
the NPRM proposed clarifying language 
with regard to ‘“‘private information’’ 
and “identifiable private information.”’ 
The pre-2018 rule used the example of 
a medical record as constituting private 
information. The NPRM added the 
example of a biospecimen in keeping 
with the proposal to expand the 
definition of “human subject’ to 
include all biospecimens. In addition, 
the NPRM proposed adding the words 
“shared or” to the description of what 
constitutes “private information,” for 
the purpose of expanding the scope of 
the information that would be described 
by that term. 

In addition, the NPRM asked for 
public comment about whether a 
different identifiability standard would 
be appropriate. One alternative 
discussed was to adopt the term 
“identifiable private information” with 
the term used across the Federal 
Government: ‘‘personally identifiable 
information”’ (PII). PII refers to 
information that can be used to 
distinguish or trace an individual’s 
identity (such as name, social security 
number, biometric records) alone, or 
when combined with other personal or 
identifying information that is linked or 
linkable to a specific individual, such as 
date and place of birth, or mother’s 
maiden name. It acknowledged that 


replacing “identifiable private 
information” with “PII” would increase 
the scope of what is subject to the 
Common Rule. Subsequent to the 
release of the NPRM, the Office of 
Management and Budget (OMB) 
updated government-wide guidance for 
managing personally identifiable 
information.18 

Related to this issue, the NPRM noted 
new legislative developments, 
specifically the Newborn Screening 
Saves Lives Reauthorization Act of 2014 
(Pub. L. 113-240), signed into law in 
December 2014. The law required 
consent for federally funded research 
with newborn dried blood spots and 
prohibits IRBs from waiving consent. 
These changes were to be effective until 
updates to the Common Rule were 
promulgated, and applied whether or 
not the newborn dried blood spots 
would be considered “identifiable 
private information” under the 
regulatory definition. 


3. Public Comments 


a. Public Comments on the Primary 
NPRM Proposal 


The proposal regarding revising the 
definition of “human subject” to 
include biospecimens regardless of 
identifiability was commented on by 
almost 50 percent of the commenters. 
Others commented on the effects such 
an expansion would have on consent 
requirements, the ability to waive 
consent, and the applicability of 
exemptions and exclusions. The vast 
majority of commenters who addressed 
this expansion (80 percent) were 
opposed to it for a variety of reasons, 
particularly because of the implications 
of this change for requiring consent for 
most research uses of biospecimens that 
were collected as part of clinical care. 

A majority of these commenters 
responded as members of the general 
public (that is, not explicitly affiliated 
with a specific organization or 
institution) or as patients (including 
family members of patients). Patients 
tended to oppose these proposals, 
focusing on the additional and more 
stringent criteria for waiver of informed 
consent because they believed the 
effects of the proposals would be that 
many people would not provide 
consent, thus restricting access by 
investigators to biospecimens, which 


18 CIRCULAR NO. A-130 Memorandum to: The 
Heads of Executive Departments and Agencies 
Subject: ‘Managing Information as a Strategic 
Resource”’. July 7, 2016. See especially, Appendix 
II: Responsibilities for Managing Personally 
Identifiable Information. Retrieved from https:// 
www.federalregister.gov/documents/2016/07/28/ 
2016-17872/revision-of-omb-circular-no-a-130- 
managing-information-as-a-strategic-resource 


would in turn slow research. 
Investigators also expressed concerns 
about the negative impact on research. 
Organizations and institutions with 
some affiliation with the research 
enterprise expressed opposition to this 
suite of proposals as well, but for 
different reasons, as discussed further 
below. 

Most support for the expansion of the 
definition of “human subject’ to 
encompass all biospecimens and its 
implications for consent, waiver of 
consent, and exempt research came 
from members of the public who argued 
that they wanted to always be consulted 
before their biospecimens were used in 
research, without exception. Within this 
group, a strong majority opposed the 
comprehensive biospecimen-related 
proposals because they were 
uncomfortable with the concept of 
broad consent (as discussed in Section 
IIV of this preamble) to any future 
research use of those biospecimens and 
the existence of any type of over-ride by 
an IRB of the requirement to obtain 
informed consent. 

Many of the commenters supporting 
the expansion stated that it would 
respect autonomy by requiring that 
nearly all research with biospecimens 
be subject to IRB review and informed 
consent requirements. Others expressed 
distrust of the medical and scientific 
enterprises. One member of the public 
felt that consent should be required for 
government research seeking to use an 
individual’s biospecimens, and that 
researchers should be required to inform 
the individual of the ‘‘who, what, how, 
and why” of the desired research. 

Many of those who expressed support 
for this proposal also indicated that they 
felt it important for their biospecimens 
to be anonymized in research activities. 
For example, a member of the public 
with experience in biobanking 
expressed a willingness to consent to 
the use of his biospecimens to advance 
science, but called for a mechanism to 
inform the public about such research 
use even if some individuals might 
decline to participate. The commenter 
stressed the importance of respecting 
the individual’s right to know and 
refuse, citing privacy concerns and 
stressing the importance of anonymity 
of biospecimens to protect individuals 
from potential negative consequences. 

Still others supported the expansion 
of the definition of “human subject’ to 
include all biospecimens because of a 
desire to receive research results or to 
financially profit from discoveries, 
implying that retaining identifying 
information with biospecimens would 
enable both of these possibilities. Some 
who felt there is an entitlement to 
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financially profit from discoveries 
described biospecimens as personal 
property. For example, one commenter 
compared the use of an individual’s 
biospecimens without consent to one 
party illegally taking another’s property 
such as land, a house, or an arm. 

Several commenters noted that 
medical services should not be allowed 
to be contingent upon a person’s 
consent to use of their leftover 
biospecimens for research despite the 
fact that this was not proposed in the 
NPRM. In fact, the pre-2018 rule states 
that informed consent must include a 
statement that “refusal to participate 
will involve no penalty or loss of 
benefits to which the subject is 
otherwise entitled’ and that element 
appears in the final rule as well. 

For example, one commenter 
indicated that patients should be 
informed and be given the opportunity 
to consent to the use of their body 
tissues, and if one declines consent, the 
individual should not be denied 
treatment or receive diminished care. In 
other words, they felt that consent 
should never be a condition of 
treatment. 

The reasons for opposing the 
expansion of the definition of “human 
subject’’ to include all biospecimens 
were numerous, including: the 
feasibility of obtaining broad consent in 
a clinical setting; the costs of obtaining, 
tagging, and tracking consents given the 
low risk nature of the research in 
question; allowing autonomy to trump 
beneficence and justice; insufficient 
evidence of risk or public concern about 
the issue; the fact that it would result in 
fewer specimens collected from fewer 
sources, with adverse implications for 
rare diseases and for justice; the idea 
that requiring all biospecimens to 
remain identified poses greater privacy 
and confidentiality risks than the 
current system; and overall negative 
impacts on research. 

Many expressed concern about the 
number of biospecimens that might no 
longer be available for research, not out 
of concern that individuals would 
decline to have their leftover tissue used 
in research, but rather because many 
hospitals and medical providers might 
decline to enact the expensive consent 
and tracking system that the NPRM 
envisioned. Some commenters were 
concerned that this would then limit the 
heterogeneity of biospecimens obtained 
and stored, as community hospitals and 
clinics might opt out of participating in 
such collections. 

Several comments suggested that for 
academic medical centers where a large 
amount of research is conducted, 
research activities often do not result in 


profits, and that the proposed policies 
would come at great costs to institutions 
already struggling to financially sustain 
a healthy research enterprise. For 
example, one commenter noted that the 
NPRM proposal would require 
additional resources to obtain consent, 
which would hinder smaller institutions 
with fewer staff or resources available in 
their ability to contribute to scientific 
and medical research, and limit the 
opportunities for patients at these 
facilities to participate in research. The 
commenter also pointed out that 
academic institutions rarely receive 
significant financial gain from their 
research, and institutions sometimes 
share biospecimens, which can be 
valuable in research, especially in the 
case of uncommon and poorly 
understood diseases. Thus, this 
commenter expressed concern that 
biospecimens might not be available for 
research given the requirements of the 
proposed policy. 

Many members of the public with rare 
diseases commented on how research 
into their specific diseases might be 
affected should the NPRM proposal be 
finalized. For example, several 
commenters expressed interest in the 
proposed rule because they or a family 
member had been diagnosed with a 
desmoid tumor, which are often limb 
threatening and sometimes life 
threatening. Research using tissue 
blocks is critical to determine how to 
treat these tumors, which are rare and 
can vary among patients. The 
commenter felt that the proposed rule 
would make desmoid tumor research 
virtually impossible by reducing access 
to the already low number of tissue 
blocks available for research. 

More than one academic medical 
center asserted that there was a lack of 
evidence that patients value their 
autonomy over the potential for 
innovative diagnostics, treatments, 
cures, or preventative interventions that 
could result from research with leftover 
biospecimens, and called for empirical 
research on whether patients, patient 
advocacy groups, and the general public 
value autonomy (in the form of written 
consent for research use of 
nonidentified biospecimens) above 
other values when explained in light of 
potential impact on medical advances. 

Some public commenters pointed out 
the illogic of treating biospecimens 
differently from information for the 
purposes of defining what constitutes a 
human subject. For instance, one 
professional organization composed of 
investigative pathologists and dozens of 
individual pathologists around the 
country noted that there are several 
areas in which the NPRM proposes 


treating biospecimens differently from 
identifiable information unjustifiably 
since both create the potential for 
identification of the donor and a 
potential negative impact on the 
individual and their family, such as 
employment or insurance 
discrimination, embarrassment, or 
stigmatization. That organization noted 
that no empirical evidence has been 
provided to indicate either that 
biospecimens pose a risk greater than 
that posed for identifiable information 
or that the public is more concerned 
about the use of biospecimens compared 
to the use of identifiable private 
information. 

One member of the public asserted 
that the research use of leftover 
biospecimens in medical research poses 
less of a privacy risk to individuals than 
market research that analyzes one’s 
attitudes, words, and behaviors and is 
used to generate commercial profit. 

Several commenters noted that the 
proposed expansion of the definition of 
“human subject” creates a cascade of 
consequences throughout the rule that 
are overly complex and unnecessary 
given the minimal risk of such research. 

Other commenters suggested that the 
NPRM proposals would have negative 
impacts on the advancement of 
precision medicine. For example, a 
research university felt that mandating 
consent for de-identified biospecimens 
would impair the ability to achieve 
precision medicine for all. The 
commenter asserted that to offer care 
tailored to the needs of each individual 
based on understanding how each 
person is affected by disease requires 
understanding differences in the origins 
and manifestations of disease in 
individual patients who differ in 
genetics and environmental exposures. 
The commenter felt that restricting 
access to nonidentified biospecimens 
would violate the principles of justice 
and beneficence because many health 
care facilities serving under-represented 
minorities and economically- 
disadvantaged individuals, particularly 
those in rural settings, might not have 
the financial resources to obtain and 
track consent. As a result, medical 
research therefore might represent a 
skewed population of individuals 
receiving care at large, research 
intensive referral centers. In addition, 
the commenter felt that compliance 
would impose an onerous and 
expensive bureaucratic burden that 
would result in many institutions no 
longer collecting and using these 
critically important specimens with the 
net effect of thwarting efforts to provide 
precision medicine for all citizens. 
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Many commenters expressed the 
opinion that the existing regulatory 
framework is adequate and that current 
practices should be maintained, 
stressing that the research use of 
nonidentified data or biospecimens 
involves minimal or low risk to the 
research subject. Furthermore, several 
commenters noted that, although it is 
theoretically plausible to identify a 
person based on their biospecimen, the 
likelihood remains remote enough to 
argue against the presumption that the 
sources of all biospecimens are 
identifiable and cited a study showing 
that the risk of re-identification from a 
system intrusion of databases was only 
0.22 percent.19 Other commenters noted 
that the existing definition of human 
subject is sufficient because once a 
biospecimen becomes identifiable in 
research, such research is considered to 
involve human subjects and therefore 
IRB review and consent or waiver of 
consent would be required. They argued 
that the current policy works and there 
has been no evidence provided that it 
needs to be fixed. 


The NPRM specifically asked whether 
the final rule should include a 
definition of ‘‘biospecimen”’ to assist the 
regulated community in understanding 
what types of activities might fall under 
the rule. Approximately 100 comments 
answered this question. A majority of 
these comments did not provide a 
suggestion for how biospecimen should 
be defined, but suggested that the 
Federal Government convene panels 
and solicit input from governmental and 
nongovernmental experts. 


One university emergency medical 
department suggested including in this 
definition biological samples from 
human subjects which contain DNA and 
are being obtained for the purpose of 
medical analysis and provided 
examples of biospecimens which would 
fall under this definition, including 
excised tissue (fresh, fixed, or paraffin 
embedded), whole blood, urine (when 
hematuria is known to exist), and saliva 
among others. The commenter also 
provided examples of biospecimens 
which would not fit in this definition, 
including serum or plasma, urine (when 
no hematuria is known to exist), and 
processed tissues where the DNA has 
been removed as a part of the 
processing. 


19 Kwok P, et al. Harder Than You Think: A Case 
Study of Re-Identification Risk of HIPAA- 
Compliant Records. NORC at The University of 
Chicago and Office of the National Coordinator for 
Health Information Technology. 2011. Retrieved 
from hittp://www.amstat.org/meetings/jsm/2011/ 
onlineprogram/AbstractDetails.cfm? 
abstractid=302255. 


Others indicated that the definition of 
biospecimen used by the National 
Cancer Institute 2° seemed appropriate 
and workable for this rule. 

A majority of comments on the 
definition of “biospecimen” asked for 
explicit clarification on how certain 
biospecimens would be treated under 
the rule. Several comments asked 
whether microbiology biospecimens 
would be considered covered under the 
NPRM proposal. One research 
university requested specification that 
biologic material of organisms that use 
human biospecimens merely as a host 
(e.g., bacteria, viruses, fungi) not be 
considered to involve human subjects. 

The NPRM also asked whether 
covering only biospecimens that include 
nucleic acids would be a reasonable 
definition. A majority of those who 
responded to this said it would not be 
a good line to draw. One commenter 
specifically noted that the presence of 
nucleic acids does not guarantee re- 
identification. 


b. Public Comments on Alternative 
NPRM Proposals A and B 


Some of the alternative NPRM 
proposals were partly based on the 
premise that biospecimens could at 
some point become readily identifiable 
as a result of increasingly sophisticated 
technology. Many public commenters 
stated that a better approach to 
protecting privacy than requiring 
consent is to impose sanctions against 
investigators who aim to or do re- 
identify biospecimens without 
authorization by an IRB or other body. 
Such an approach, they said, would be 
less onerous for the entire enterprise, 
and if accompanied by clear guidance 
from funding agencies, would do more 
to protect privacy and guard against 
potential harms to subject rights and 
welfare. 

Few commenters, approximately 20, 
explicitly supported Alternative A or B 
over the NPRM proposal or the pre-2018 
rule. 

The Presidential Commission for the 
Study of Bioethical Issues explicitly 
supported Alternative B, noting that it is 
the most forward-looking of all three 


20 NCI defines ‘“‘biospecimen” as, “A quantity of 
tissue, blood, urine, or other human-derived 
material. A single biopsy may generate several 
biospecimens, including multiple paraffin blocks or 
frozen biospecimens. A biospecimen can comprise 
subcellular structures, cells, tissue (e.g., bone, 
muscle, connective tissue, and skin), organs (e.g., 
liver, bladder, heart, and kidney), blood, gametes 
(sperm and ova), embryos, fetal tissue, and waste 
(urine, feces, sweat, hair and nail clippings, shed 
epithelial cells, and placenta). Portions or aliquots 
of a biospecimen are referred to as samples (NCI 
Best Practices working definition).’”’ Retrieved from 
http://biospecimens.cancer.gov/bestpractices/got/ 
#B. Last modified March 16, 2016. 


proposals, using “‘bio-unique’’ data as 
human subjects research with a focus on 
the technology and its ability to identify 
donors using small amounts of data, as 
opposed to tying the definition of 
human subjects research to a particular 
kind of data.21 Another commenter 
identified alternative B as the best 
proposal to keep pace with advances in 
technology (including technologies 
driving personalized medicine), protect 
research participants, respect autonomy, 
increase trust, and close the gap in 
protection in the current regulations. 

Those who supported the primary 
NPRM proposal—to expand the 
definition of “human subject” to 
include all biospecimens—indicated 
that Alternatives A and B would not 
give individuals who wanted to control 
the use of their biospecimens the 
opportunity to do so. 

Approximately 250 commenters 
(about 12 percent of the total comments 
received) said that they endorsed the 
pre-2018 policy, but that if the Federal 
Government must do something other 
than maintain the current definition of 
human subject, Alternative A would be 
preferable to the NPRM proposal or to 
Alternative B. These comments argued 
that Alternative A would be the least 
disruptive to the research enterprise, but 
that the pre-2018 policy would be 
better. 

However, the majority of those 
commenters addressing the alternative 
proposals indicated that neither struck 
an appropriate balance among the 
Belmont Report principles. A research 
university concluded that both 
alternatives lack balance, emphasizing 
respect for persons with little regard for 
the principles of beneficence and 
justice. 

Additional concerns about Alternative 
A included the fact that while limiting 
the expansion of the scope of activities 
covered by the rule to whole genome 
sequencing may be a reasonable line for 
inclusion today, that line might not be 
inclusive enough in the future. 

Additional concerns about Alternative 
B included that by requiring continual 
re-review of technologies and databases 
by the federal government, there would 
be an “inevitable lag” between when a 
technology might be identified and 
when it would be added to the list. 
Thus, these commenters argued that the 
list might end up being useless. 


21 The Commission had previously addressed 
related issues in its October 2012 report, Privacy 
and Progress in Whole Genome Sequencing. 
Washington, DC: Presidential Advisory Commission 
for the Study of Bioethical Issues. Retrieved from 
http://bioethics.gov/sites/default/files/ 
PrivacyProgress508__1.pdf. 
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c. Alternative Proposals Offered by 
Public Commenters 


Many commenters proposed or 
endorsed alternatives to the NPRM 
proposals. Generally, these alternatives 
involved maintaining the existing 
schema, developing a system of notice 
and opt out, engaging in a public 
education campaign about how the 
research enterprise works, and 
developing penalties and sanctions for 
re-identification of biospecimens and 
information. A policy that requires 
notice, opt out, and public education 
were generally endorsed or discussed 
together. 

The Secretary’s Advisory Committee 
on Human Research Protections 
(SACHRP) offered one of the most 
detailed alternative proposals. SACHRP 
indicated that existing practices of 
research with biospecimens and data 
that have been collected for nonresearch 
uses (most often in the course of clinical 
care) should be revised to better protect 
subjects through greater transparency, 
public education about research with 
biospecimens, more exacting standards 
for protecting against dignity harms, 
allowing individuals to opt out, 
requiring IRB or institutional review 
and approval of specific research uses of 
identified biospecimens and identified 
data, and through strict legal 
consequences for re-identification of de- 
identified biospecimens and data that 
have been shared for research purposes. 

SACHRP also proposed that data 
security protections be developed to 
safeguard biospecimen-associated data 
and identified data against unauthorized 
release or access, and focused review of 
the storage, maintenance, or secondary 
research use of identified biospecimens 
and identified data to determine 
whether the proposed activity is likely 
to be objectionable. 

A professional organization of 
investigative pathologists urged 
consideration of opt-out broad consent 
models for nonidentified biospecimens 
collected in research and nonresearch 
settings, and suggested that this model 
would bring consent for the broad use 
of nonidentified biospecimens in line 
with HIPAA privacy practices, 
preserving the ability for an individual 
to decide not to participate in research 
efforts. This organization asserted that 
this option would be less burdensome 
and an inclusive, respectful, and 
functional way to promote ethically 
conducted biomedical research on 
biospecimens. 


d. Public Comments on Identifiability 


Approximately 40 comments were 
received in response to the request to 


comment on the definition of 
identifiable private information. 
Comments were mixed. The largest 
proportion of those comments 
(approximately 13) supported the 
definition in the pre-2018 rule. Others 
felt that the pre-2018 definition of 
identifiable private information was 
sufficient, but that additional guidance 
would be needed to implement it. 
Another group of commenters 
supported adopting a different 
identifiability standard in the final rule 
(such as the federal government’s 
personally identifiable information 
standard, or the HIPAA identifiability 
standard). 

Several public comments claimed that 
the meaning of ‘‘identifiable” with 
regard to information and biospecimens 
will change as technology advances. 
They indicated that the technique of 
whole genome sequencing altered the 
conversations about the identifiability of 
biospecimens and future technological 
advances using advanced computing 
and large databases could provide 
methods for easily aggregating disparate 
data for the purposes of identifying an 
individual. 

Public comments received from a 
large professional association related to 
the definition of identifiable private 
information noted that the modifier 
“may be readily ascertained” that was 
included in the definition of identifiable 
private information within the 
definition of human subject allows for 
changes in scientific technology and 
data sharing over time since what was 
readily ascertainable 10 years ago has 
changed and will be different 10 years 
from now. The commenter noted that 
this allows IRBs and investigators to 
assess identifiability based on current 
technology, data sharing and computing 
capabilities, rather than comparing it to 
an enumerated list of identifiers or 
scientific technologies. 

Some commenters expressed a desire 
for guidance to be issued on these 
definitions or for the definitions to be 
better clarified and explained in the 
regulatory text. Several comments 
specifically suggested a need for a 
definition of or guidance on the term 
“readily ascertainable.” 

Approximately 10 comments 
endorsed replacing the Common Rule’s 
identifiability standard with either the 
Federal Government’s concept of 
personally identifiable information (PID 
or HIPAA’s concept of protected health 
information (PHI). 

One academic medical center felt that 
the concept of PII would unnecessarily 
broaden the scope of the Common Rule 
and create a larger administrative 
burden due to the vagueness of the PII 


definition without providing substantial 
added protection to human subjects, 
and suggested replacing the term 
“identifiable private information” with 
the definition of ‘‘protected health 
information,” which can be found at 45 
CFR 160.103. 

Those who supported the use of the 
PII concept noted that it would 
harmonize other definitions of 
identifiability used in other Federal 
Government regulations. One state 
department of health and human 
services noted that adopting PII would 
be consistent with other confidentiality 
laws, policies, and industry standards 
that require organizations to protect the 
privacy and security of PII, achieving 
consistency across standards and 
helping organizations comply with the 
various privacy and security 
requirements. The commenter felt that 
replacing the identifiable private 
information standard with the concept 
of PII should not be overly burdensome 
on the research community since 
exemptions and waivers of informed 
consent would likely apply in many 
contexts. 

A few commenters also noted that 
regardless of how identifiability might 
be defined, some concerns about group 
harms still were not addressed in the 
NPRM. 

Several other commenters noted that 
a change to the definition of PII would 
not increase public trust or 
understanding of the system, nor would 
it likely clarify for investigators whether 
biospecimens or private information are 
identifiable. 

A majority of the commenters noted 
that whatever direction the final rule 
takes; additional guidance will be 
necessary to reduce ambiguity within 
the regulated community. 


e. Public Comments on Newborn Dried 
Blood Spots 


Approximately 50 comments 
discussed how issues related to research 
use of residual newborn dried blood 
spots (DBS) were addressed by the 
proposal to expand the definition of 
human subject. Of those comments, 35 
supported the idea of parental consent 
for research with DBS. Thirty-two 
comments stated that specific consent 
should be required for all research uses, 
in other words, that the exemptions and 
exclusion categories should not apply to 
research involving DBS. Those who felt 
that parental consent should always be 
required for the research use of DBS 
expressed the need to respect autonomy 
and parents’ rights, and frequently 
conveyed a distrust of medicine and 
scientists. These individuals generally 
supported the spirit of the main NPRM 
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proposal, but objected to any 
exemptions, exclusions, and waivers of 
informed consent. 

Fifteen comments expressed concerns 
that the biospecimen proposals in the 
NPRM would impede research 
involving DBS, which could negatively 
affect the expansion and improvement 
of newborn screening programs due to, 
among other things, a possible lack of 
resources for obtaining consent. In this 
regard, an employee of a California state 
health department described the health 
department’s experience of seeking and 
obtaining consent for the research use of 
DBS. This individual noted that 52 
percent of new parents were offered the 
opportunity to consent. Of those offered 
the opportunity, 90 percent said yes. 
This employee was thus concerned that 
due to staffing constraints, the majority 
of new parents simply would not be 
asked to provide consent to future 
research uses of DBS. 

Others indicated that some kind of 
notice and opt-out process would be 
acceptable, but that as a general matter 
the research community would benefit 
from guidance on the extent to which 
the exemptions and exclusions apply to 
this type of work. 


4. Response to Comments and 
Explanation of the Final Rule: 
Definition of Human Subject 


The final rule does not implement the 
proposed expansion of the definition of 
“human subject” to include all 
biospecimens regardless of 
identifiability. It is clear from the 
comments received that the public has 
significant and appropriate concern 
about both the need for obtaining 
consent before using such biospecimens 
for research, and the potential negative 
impacts of implementing that proposal 
on the ability to conduct research. And, 
while it does not substantially change 
the definition of ‘‘identifiable private 
information,” the final rule includes a 
new process by which Common Rule 
departments and agencies can regularly 
assess the scientific and technological 
landscape to determine whether new 
developments merit reconsideration of 
how identifiability of either information 
or biospecimens is interpreted in the 
context of research. Because the final 
rule does not implement the NPRM’s 
proposed expansion to the definition of 
“human subject,” it also does not 
implement the NPRM proposal to 
exclude certain research activities 
involving nonidentified biospecimens. 

With regard to changing the definition 
of “human subject” to include all 
biospecimens, the majority of 
commenters who addressed this 
expansion opposed it for a variety of 


reasons, as described above. As 
explained in the NPRM, one of the core 
reasons for proposing that the rule be 
broadened to cover all biospecimens, 
regardless of identifiability, was based 
on the premise that continuing to allow 
secondary research with biospecimens 
collected without consent for research 
places the publicly funded research 
enterprise in an increasingly untenable 
position because it is not consistent 
with the majority of the public’s wishes, 
which reflect legitimate autonomy 
interests. However, the public 
comments on this proposal raise 
sufficient questions about this premise 
such that we have determined that the 
proposal should not be adopted in this 
final rule. 

Further, the current regulatory policy 
appears to sufficiently protect against 
the unauthorized research use of 
identifiable biospecimens. Under the 
pre-2018 rule, if an investigator funded 
by a Common Rule department or 
agency uses nonidentified biospecimens 
and manages to re-identify them, that 
investigator would then be conducting 
human subjects research without IRB 
approval, in violation of the rules. It 
should also be noted that the position 
adopted in the final rule does not 
eliminate any authority, separate and 
apart from the Common Rule, that 
Common Rule departments and 
agencies have to establish policies with 
additional requirements related to 
consent for research involving 
nonidentifiable biospecimens or 
nonidentifiable private information, or 
preclude them from exercising such 
authority. 

Nonetheless, we acknowledge the 
need to also appropriately respect and 
promote autonomy interests. Any future 
proposals aimed at promoting autonomy 
should jointly evaluate the importance 
of the autonomy interests at issue, as 
well as explicitly quantify the potential 
negative impacts the proposal might 
have on the ability to conduct research, 
including such consequences on the 
representativeness of biospecimens 
available for research. 

In the final rule, we have added 
requirements to the informed consent 
process to increase transparency so that 
potential subjects will have more 
information about how their 
biospecimens or private information 
might be used. Specifically, prospective 
subjects will be told that identifiers 
might be removed from their 
biospecimens or private information 
and used for future research, if this 
might be a possibility. Finally, as some 
public comments addressed the desire 
to share in any profits that might accrue 
as a result of research use of their 


biospecimens, an additional element of 
consent will require, as appropriate, a 
statement that the subject’s 
biospecimens may be used for 
commercial profit and whether the 
subject will or will not share in this 
commercial profit. We believe that this 
increased attention to transparency in 
the consent process will allow 
individuals to make informed choices 
about whether they want to consent to 
current or future research uses of their 
biospecimens. A few clarifying changes 
are made in the final rule pertaining to 
the definition of ‘““human subject’ and 
the components within that definition, 
particularly referring to both 
information and biospecimens as key 
determinants of whether a human 
subject is involved in research. 

With respect to the definition of 
“identifiable private information,” 
although the pre-2018 definition of 
“identifiable” did not incorporate a 
specific process for considering the 
growing volume of information being 
generated and shared in research 
(including from biospecimens), or 
consider how evolving technology can 
ease and speed the ability to re-identify 
information or biospecimens previously 
considered nonidentifiable, we 
appreciate that a change in that 
definition could have collateral 
implications with respect to imposing 
unwarranted consent requirements on 
activities that were not subject to the 
regulations. We appreciate the 
commenter requests for more guidance 
on how they should interpret the 
definition of identifiable private 
information. Thus, although the final 
rule only makes minor changes to the 
existing definition of “identifiable 
private information,” it sets in place a 
process (§ .102(e)(7), discussed 
below) that will help facilitate any 
necessary future updates to the 
understanding of that term. 

In the final rule the language at 
§ _.102(e)(1)(i) relating to 
information obtained through 
intervention or interaction with an 
individual was adopted and modified 
by replacing the reference to data, as 
proposed in the NPRM, with a reference 
to information or biospecimens, and by 
adding the NPRM-proposed language 
relating to using, studying, or analyzing 
the information or biospecimens. The 
explicit reference to biospecimens in 
this context is intended as a mere 
clarification of the previous 
understanding of how the pre-2018 rule 
operated. 

Likewise, the final rule adopts the 
NPRM-proposed language at 
§ _.102(e)(1)(ii) relating to obtaining 
identifiable private information, but 





Federal Register/Vol. 82, No. 12/Thursday, January 19, 2017/Rules and Regulations 


7169 








modifies it by adding an explicit 
reference to ‘identifiable 
biospecimens.”’ This is also intended as 
a mere clarification of the previous 
understanding of how the pre-2018 rule 
operated as applied to biospecimens. 
Similarly, the definition of intervention 
has been modified to clarify that 
information or biospecimens might be 
gathered, replacing the former reference 
only to data. This, too, is merely a 
clarification of the existing 
understanding of that concept. 

A definition of “identifiable 
biospecimen”’ has been added at 
§ _.102(e)(6). This new definition 
was not added as a result of any 
substantive change, but rather to enable 
greater clarity in other provisions of 
these regulations in explaining when a 
particular provision relates to either 
identifiable private information alone 
(not including biospecimens), or 
identifiable biospecimens alone, or 
both. The pre-2018 rule’s concept of 
“identifiable private information’’ had 
encompassed the concept of an 
identifiable biospecimen, whereas 
under the final rule that concept has 
been ‘cleaved off” from that definition 
and given its own definition. Note that 
a biospecimen is deemed to include 
private information (consistent with the 
understanding of this concept under the 
pre-2018 rule), so there is no need to 
add the adjective ‘‘private’’ in the 
definition of an “identifiable 
biospecimen.”’ In effect, once a 
biospecimen becomes identifiable (for 
example, by being tagged with the name 
or other information that indicates the 
person from whom the biospecimen was 
obtained), then an investigator using 
that biospecimen is already using 
something to which § _.102(e)(1)(ii) 
would apply. There is no need to make 
any additional determination about the 
“private” aspects of what is taking 
place. 

In addition, the minor clarifying 
change in the language for the concept 
of ‘‘private information” that was 
proposed in the NPRM, namely adding 
the phrase ‘“‘shared or,” was not 
adopted. It was decided that because 
any information that should not be 
shared would always meet the standard 
of being information that should not be 
made public, this change would not 
actually expand the amount of 
information that is considered private 
information. 

Although the description of when 
private information is identifiable was 
not significantly changed, a new 
provision has been added at 
§ _.102(e)(7) requiring federal 
departments and agencies that 
implement the Common Rule to 


regularly, upon consultation with 
appropriate experts, reexamine the 
meaning of the terms ‘‘identifiable 
private information,” as defined in 

§ _.102(e)(5), and ‘‘identifiable 
biospecimen,” as defined in 

§ _.102(e)(6). Such reexamination 
shall take place at least every 4 years. 
This new provision specifically requires 
that the federal departments and 
agencies implementing this policy 
collaborate on this process to avoid a 
duplication of efforts and in order to 
have a consistent interpretation of these 
terms. 

This new process responds to the 
growing volume of information being 
generated and shared in research 
(including from biospecimens), and 
evolving technology that can ease and 
speed the ability to re-identify 
information or biospecimens previously 
considered nonidentifiable. With an 
increase in the number of exemptions 
included in this final rule, it will be 
important to reconsider the potential 
identifiability of information and 
biospecimens and facilitate uniform 
interpretation to ensure adequate 
privacy and security measures are in 
place. 

Section 102(e)(7) also provides that, 
after conducting this process, if it is 
determined to be appropriate and 
permitted by law, Common Rule 
departments and agencies could alter 
the interpretation of identifiable private 
information or identifiable 
biospecimens, including through the 
use of guidance. 

In addition, there will occur, also at 
least every 4 years and as a collaborative 
process among those federal 
departments and agencies, upon 
consultation with appropriate experts, 
an assessment as to whether there are 
analytic technologies and techniques 
that should be considered by 
investigators to generate identifiable 
private information or identifiable 
biospecimens. The ultimate goal is to 
implement the Common Rule in a way 
that is aligned with the evolving 
understanding of the concept of 
identifiability while protecting subjects 
and encouraging and facilitating 
valuable research. 

To the extent that this process leads 
to a determination that particular 
analytic technologies or techniques, 
when applied to information or 
biospecimens that are not identified, do 
lead to the generation of identifiable 
private information or identifiable 
biospecimens, those technologies or 
techniques will be placed on a list of 
technologies and techniques satisfying 
that determination, and 
recommendations might accordingly be 


made with regard to relevant issues 
relating to consent and privacy and data 
security protections. The result may be 
that such technologies and techniques 
could therefore only be used in 
instances where the person has 
provided their consent (broad or study- 
specific) which meets the requirements 
of the Common Rule, or where an IRB 
has waived the requirement for consent. 

Notice and the opportunity for public 
comment would take place before a 
technology or technique could be placed 
on this list. The expectation is that 
whole genome sequencing will be one of 
the first technologies to be evaluated to 
determine whether it should be placed 
on this list. 

It is important to note that an 
investigator who possesses information 
or biospecimens to which such a 
technology or technique might be 
applied is not to be considered in 
possession of identifiable private 
information or identifiable 
biospecimens merely as a result of such 
a circumstance: that would only be true 
were the investigator to actually apply 
the technology or technique to generate 
identifiable private information or 
identifiable biospecimens. 

This new provision is not being added 
as a result of any pre-conceived 
determination that there is indeed a 
need to change, whether by guidance or 
otherwise, the interpretation of 
“individually identifiable” as that 
concept is currently interpreted. 
Consistent with a core theme 
underpinning the process that led to 
this final rule, it would be inappropriate 
to expand the scope of coverage of the 
Common Rule with regard to activities 
that usually involve very little risk 
absent good reason to think that there is 
a problem that the added administrative 
burden will be correcting. The public 
comments on both the ANPRM and the 
NPRM do not identify a specific 
problem, but clarification from the 
regulatory agencies might be useful. 
Thus, apart from the consequences of 
placing technologies and techniques on 
the new list, the most significant effect 
of § _.102(e)(7) may be the issuance 
of guidance from time to time that 
facilitates understanding of and 
compliance with existing 
interpretations. 

Finally, with regard to the use of 
newborn DBS, retaining the pre-2018 
approach toward nonidentified 
biospecimens resolves many of the 
concerns expressed by commenters who 
felt that important research involving 
newborn screening would be halted or 
inhibited under the NPRM. The 
Newborn Screening Saves Lives 
Reauthorization Act of 2014 (Pub. L. 
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113-240) will no longer be effective 
following the effective date of this final 
rule, given that its changes applied only 
until changes to the Common Rule were 
promulgated. As a result, under the final 
rule, secondary research with 
nonidentified newborn DBS would be 
treated in the same way as secondary 
research with any other type of 
nonidentified biospecimen. Such 
research would not be considered 
research with human subjects under the 
final rule, and thus would not be subject 
to the rule. 


E. Legally Authorized Representative 
(§ .102(i)}) 


1. Background and Pre-2018 
Requirements 


The Common Rule contains a 
definition of legally authorized 
representative to clarify who can 
consent on behalf of a prospective 
subject who is unable to consent to 
research participation on his or her own 
behalf. Under the pre-2018 rule, a 
legally authorized representative was 
defined as an individual or judicial or 
other body authorized under applicable 
law to consent on behalf of a 
prospective subject to the subject’s 
participation in the procedure(s) 
involved in the research. 


As there is no federal legal standard 
as to who, or what entity, is authorized 
to serve as a legally authorized 
representative to provide consent to a 
subject’s research participation, the 
issue of who can serve as a legally 
authorized representative has been 
determined by the laws of the 
jurisdiction in which the research will 
be conducted. Within the United States, 
this generally means state or local law. 
“Applicable law” could be a state 
statute or regulation, case law on point, 
an opinion of a State Attorney General, 
or a combination of these. 


Some states and jurisdictions have 
statutes, regulations, or common law 
that specifically address consent by 
someone other than the subject for 
participation in research. Most states 
and jurisdictions have no law 
specifically addressing the issue of 
consent in the research context. In these 
states and jurisdictions, law that 
addresses who is authorized to give 
consent on behalf of another person to 
specific medical procedures or generally 
to clinical care may be relevant if those 
types of procedures are the procedures 
involved in the research. The long- 
standing interpretation by OHRP has 
been that such laws relating to surrogate 
consent in the clinical context can be 
used for purposes of the Common Rule. 


In every state, a legally authorized 
representative can be authorized 
through an advance directive or by a 
court through guardianship 
proceedings. However some states have 
no law specifically addressing the issue 
of consent by a surrogate in the research 
setting, and some states have no 
applicable statutes, regulations, or 
common law specifying when an 
individual can provide consent for 
another to medical treatment. In the 
absence of such law, it is usually the 
case that community or other standards 
(such as institutional policies) define 
hierarchies or identify individuals who 
are allowed to provide consent, for 
medical treatment purposes, on behalf 
of others who cannot consent for 
themselves. 

SACHRP and the Presidential 
Commission for the Study of Bioethical 
Issues have raised concerns that the 
definition of legally authorized 
representative may be inappropriately 
hindering the conduct of research with 
subjects who lack capacity to consent. 
In the second part of its report on 
neuroscience and ethics, Gray Matters: 
Topics at the Intersection of 
Neuroscience, Ethics, and Society 
(Volume 2), the Commission 
recommended that federal regulatory 
agencies establish clear requirements to 
identify who can serve as legally 
authorized representatives for 
individuals with impaired decision- 
making capacity to support their 
responsible inclusion in research.22 


2. NPRM Proposal 


Although the NPRM did not propose 
regulatory text that would change the 
definition of “legally authorized 
representative,” it requested public 
comment on whether we should modify 
the definition in light of the definition’s 
reference to persons or entities 
“authorized under applicable law.” 

The NPRM sought comment on 
whether expansion of the current 
definition to permit a legally authorized 
representative to be defined by an 
accepted common practice standard 
within a state or jurisdiction that lacks 
applicable state law for determining 
who can legally consent to clinical care 
would be consistent with the ethical 
principles underlying the Common 
Rule. The NPRM proposed to allow use 
of this alternative standard only in 
jurisdictions in which there is also no 


22 Presidential Commission for the Study of 
Bioethical Issues. Gray Matters: Topics at the 
Intersection of Neuroscience, Ethics, and Society 
(Volume 2). Washington, DC: Presidential 
Commission for the Study of Bioethical Issues, 
2015. Retrieved from http://bioethics.gov/sites/ 
default/files/GrayMatter__V2__508.pdf 


applicable law affirmatively authorizing 
a legally authorized representative to 
provide consent to the subject’s research 
participation. 


3. Public Comments 


Approximately 60 commenters 
discussed the Common Rule’s definition 
of “legally authorized representative.” A 
clear majority supported the goal of 
addressing the barrier that the 
regulatory definition of “legally 
authorized representative” poses in 
jurisdictions that have no applicable 
law affirmatively authorizing an 
individual to provide consent for 
another. Commenters also favored the 
suggested approach and responded that 
including the allowance of an accepted 
common practice standard would still 
appropriately protect subjects. About 
one-third of the commenters responding 
to this question, including disability 
rights organizations, advocacy 
organizations, and academic 
institutions, did not agree with the 
direction of the contemplated 
modification or whether this issue 
should be addressed through regulatory 
change. 

Those supporting a modified 
definition generally agreed that 
broadening the definition to cover 
anyone considered acceptable to 
provide consent for another individual 
in the clinical setting would be 
appropriate, would represent an 
alignment with accepted common 
practice, and would bring consistency to 
the consent process for the jurisdictions 
that are silent on both who may provide 
consent for clinical care and who may 
provide consent for research. A number 
of commenters who supported the 
proposal for modification noted that 
state law authorizing individuals to 
provide consent would continue to 
apply. 

Among the commenters who opposed 
the modification, several said state law 
provides sufficient guidance regarding 
the hierarchy of those who can consent 
for an adult incapable of consenting on 
his or her own behalf, and reduces the 
institution’s liability in the event that an 
inappropriate person consents for the 
subject. A research institution 
recommended that we reassess this 
proposal and include more specific 
requirements and details as to the role 
and authority of the legally authorized 
representative. A disability rights 
organization, while recognizing that the 
pre-2018 standard is not acceptable, 
commented that the problem is not 
solved by incorporating broad discretion 
among different jurisdictions. The 
organization also opined that a common 
practice standard does not provide 
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sufficient guidance to assess and 
balance reasonable risk, considering that 
a legally authorized representative’s 
consent is not equivalent to an 
autonomous decision by the subject. A 
research subject advocacy organization 
expressed concern that such a change 
would not provide sufficient oversight 
of investigators, who might use this 
standard in a way that would violate 
local law. Another commenter stated 
that certain individuals may be 
considered able to give consent for 
participation in clinical procedures for 
individuals unable to do so for 
themselves, but may not have the best 
interests of the individual in mind. 

Commenters responded specifically to 
the solicitation of comment on the 
proposed standard of “‘accepted 
common practice” and indicated that 
practices for surrogate consent should 
be those used in clinical settings. 
Several commenters provided ideas for 
a more specific approach to interpreting 
the terms “‘accepted” and ‘“‘common.” A 
researchers’ association commented that 
interpretation of these terms should 
include standards that define 
hierarchies or identify individuals who 
may provide legally acceptable consent, 
for clinical purposes, on behalf of others 
who cannot consent for themselves. One 
commenter supporting the modification 
suggested that the terms could be 
defined to refer to the historically used 
form of governing and familial decision 
making within the group of subjects. A 
research institution commented that an 
IRB’s careful review and documentation 
of who may serve as a legally authorized 
representative would be preferable to an 
accepted common practice standard, as 
that standard is vague. A research 
institution commenting in support of 
broadening the definition to those who 
are allowed to consent to clinical 
procedures advised that this would 
reduce confusion between physicians 
and researchers as to who can consent 
for whom in research situations, and 
suggested that the terms “accepted” and 
“common”’ should refer to the 
conducting institution’s own policies on 
who can provide consent to clinical 
procedures. 


4. Responses to Comments and 
Explanation of the Final Rule: 
Definition of Legally Authorized 
Representative 


The definition of legally authorized 
representative in the final rule at 
§ _.102(i) has been modified to 
address jurisdictions in which no 
applicable law authorizes a legally 
authorized representative to provide 
consent on behalf of a prospective 
research subject. In these jurisdictions, 


an individual recognized by 
institutional policy as acceptable for 
providing consent in the nonresearch 
context to the subject’s participation in 
the procedures involved in the research, 
will now be considered a legally 
authorized representative for purposes 
of this rule. 

The change made from the NPRM 
discussion that “‘accepted common 
practice” could be used to identify a 
legally authorized representative is in 
response to objections to the vagueness 
of these terms and the potential for 
confusion in implementation, which 
was expressed by the majority of 
commenters opposed to the proposal. 
We agree with the commenters’ 
suggestion that an institution’s own 
policies as to surrogate consent may be 
a better touchstone than ‘“‘accepted 
common practice,” as a standard 
referencing institutional policy will 
provide additional clarity as to who may 
serve as a legally authorized 
representative at that particular 
institution. 

The final rule also differs from the 
NPRM discussion in that it allows 
institutional policies applicable to 
surrogate consent in either the clinical 
context, or other nonresearch contexts, 
to authorize a legally authorized 
representative. We expect that 
implementation of this aspect of the 
final rule definition will in large part 
rely on institutional policies for 
determining surrogates for clinical 
decision making. In those instances, 
there is relatively little risk that this rule 
will have inappropriate consequences, 
as far more significant considerations, 
not related to the Common Rule, play a 
role in shaping and constraining an 
institution’s policies relating to 
surrogate decision making in the 
clinical context. 

However, we recognize that some 
studies could be taking place that do not 
relate to the types of decisions that are 
involved in clinical care, or that do not 
involve procedures utilized in the 
clinical context. If the institution has a 
policy relating to who acts as a surrogate 
outside of the research context for those 
types of decisions, then such a policy 
could be employed in the research 
context. Similar to our assessment of 
policies relating to surrogate decision 
making in the clinical context, we 
expect that considerations not related to 
the Common Rule would constrain the 
institution’s design and implementation 
of policies in other nonresearch 
contexts, and thus see relatively little 
risk that this added regulatory flexibility 
will have inappropriate consequences. 

Maintaining the pre-2018 standard 
would have continued to allow 


disparate results in terms of when 
research can take place in those states 
that have specific laws governing either 
surrogate clinical consent or research 
consent, and those that do not. 
Accepting that the Common Rule has 
been interpreted to allow the use of laws 
governing surrogate consent in the 
clinical context to be applied to 
surrogate decision making in the 
research context, it is difficult to see 
why there should be different outcomes 
in terms of what research is allowable 
based on whether the standards for 
surrogate consent in the clinical context 
in a state are based on specific laws or 
some other accepted regime. 

This outcome also appears 
inconsistent with the Belmont Report 
principle of justice. Individuals who 
lack the capacity to consent to research 
ought not be inappropriately excluded 
from research participation based solely 
on these circumstances. Research that 
an IRB has approved as ethical to 
conduct with the participation of 
subjects with impaired decision-making 
capacity ought not be prohibited in the 
few states and jurisdictions in which no 
affirmative law authorizing a legally 
authorized representative exists, while 
being allowed to proceed in the vast 
majority of states and jurisdictions that 
have laws specifically authorizing 
consent by a legally authorized 
representative in the clinical or research 
context. 

Reduced ambiguity in the 
interpretation of the regulatory 
requirements will facilitate research that 
may offer the promise of improved 
medical treatment for this subject 
population, thus increasing beneficence. 
This approach reflects the calls for 
increased clarity in the regulatory 
requirements regarding who may serve 
as a legally authorized representative, 
which will serve to facilitate the 
responsible inclusion of subjects who 
cannot consent on their own behalf to 
research participation. 


F. Minimal Risk (§ .102(j)) 


1. Background and Pre-2018 
Requirements 


The concept of ‘‘minimal risk’’ is 
central to numerous aspects of the 
Common Rule, as it affects the type of 
review required, the permissibility of 
waiver of informed consent, 
considerations for IRBs in the review 
process, and the frequency of review. In 
sum, the review process has been 
calibrated, for the most part, to the risk 
of the research. For example, under the 
pre-2018 rule at§ 110, a research 
study could receive expedited review if 
the research activities to be conducted 
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appeared on the list of activities 
published by the Secretary of HHS that 
are eligible for such review,23 and found 
by the reviewer(s) to involve no more 
than minimal risk. Under an expedited 
review procedure, the review could be 
carried out by the IRB chairperson or by 
one or more experienced reviewers 
designated by the chairperson. 


The definition of “minimal risk” in 
the pre-2018 rule at§ —_—.102(i) 
encompassed research activities where 
the probability and magnitude of harm 
or discomfort anticipated in the research 
are not greater in and of themselves than 
those ordinarily encountered in daily 
life or during the performance of routine 
physical or psychological examinations 
or tests. IRBs report challenges in 
assessing the level of risk presented by 
some studies in order to make the 
critical minimal risk determination. 
This is, in part, due to the difficulties in 
applying the definition of minimal risk 
under the pre-2018 rule, particularly 
because the terms “ordinarily 
encountered in daily life’ and ‘‘routine 
physical or psychological examinations 
or tests” are not clarified. 


2. NPRM Proposal 


The NPRM did not propose to modify 
the definition of ‘‘minimal risk,’ but 
rather proposed adding to the definition 
a requirement that the Secretary of HHS 
create and publish a list of activities that 
qualify as ‘‘minimal risk.” This list 
would be re-evaluated periodically, but 
at least every 8 years, based on 
recommendations from federal 
departments and agencies and the 
public. This would not be an exhaustive 
list of all activities that should be 
considered minimal risk under the 
Common Rule, but would allow IRBs to 
rely on the determination of minimal 
risk for activities appearing on the list. 
IRBs would still need to make minimal 
risk determinations about activities that 
do not appear on this list. The public 
was asked to comment on whether 8 
years was a reasonable time period for 
updating the list and whether advice 
should be solicited from outside parties 
when updating the list. The public was 
also asked to comment on whether the 
Secretary’s list would be a useful tool 
for the research community, and 
whether it would represent a loss of IRB 
flexibility in risk determinations. 


23 HHS. Office for Human Research Protections . 
Categories of Research That May Be Reviewed by 
the Institutional Review Board (IRB) through an 
Expedited Review Procedure. November 9, 1998. 
Retrieved from http://www.hhs.gov/ohrp/policy/ 
expedited98.html. 


3. Public Comments 


Approximately 100 comments were 
received on this proposal. A strong 
majority supported the proposal, stating 
that it would be useful to have such a 
list, and some even suggested that the 
list of minimal risk activities should be 
reviewed more often than once every 8 
years. One research university suggested 
that it is impossible to determine the 
future direction of human research and 
therefore a list of minimal risk activities 
would need to be updated at least 
yearly. 


Several commenters, including those 
who supported this proposal generally, 
stated that even though this list of 
minimal risk activities was a good idea 
in theory, it should be developed 
separately from a final rule to allow for 
more time to work collaboratively with 
other Common Rule departments and 
agencies and with members of the 
regulated community. Some of those 
who supported the proposal asked that 
there be widely solicited public input 
on the list. Others who supported the 
proposal noted the list does not 
represent a loss of flexibility because the 
IRB can still override the presumption 
of minimal risk as long as the rationale 
is documented. One large research 
university felt that the Secretary’s list 
should not replace the IRB’s discretion 
to review a study, particularly if it will 
only be updated periodically. One 
commenter was opposed to the NPRM 
proposal that the list be further codified, 
suggesting that it should instead be 
eliminated as a regulatory yardstick to 
simplify the regulations and remove 
added administrative burden. 


4. Response to Comments and 
Explanation of the Final Rule: 
Definition of Minimal Risk 


Although this proposal received 
significant support, several commenters 
expressed concern that the Secretary’s 
list was another NPRM deliverable that 
the public did not have a chance to see 
and comment on during the NPRM 
public comment period. These 
commenters suggested that this proposal 
be removed from a final rule and 
developed on a separate track. We agree 
that this list should be developed as a 
separate process from the final rule 
promulgation, and thus this proposal 
has not been included in the final rule. 


Thus, no change is made to the 
definition of “minimal risk”’ in the final 
tule at§ —_—.102(j). We still intend to 
publish guidance on this issue and 
could still pursue publication of such a 
list in the future. 


G. Public Health Authority 
(§ .102(k)) 


The pre-2018 rule did not provide a 
definition of ‘‘public health authority.”’ 
As proposed in the NPRM, the final rule 
now defines the term so that references 
to it in the definition of research are 
understood. Specifically, because the 
definition of ‘‘research’’ 
(§___.102(1)(2)) removes from that 
definition public health surveillance 
activities that are conducted, supported, 
requested, ordered, required, or 
authorized by a public health authority, 
this definition of ‘‘public health 
authority” clarifies the scope of the 
activities removed from the definition of 
“research” for the purposes of this final 
rule. 

In the final rule, as in the NPRM, the 
term “public health authority” 24 means 
an agency or authority of the United 
States, a state, a territory, a political 
subdivision of a state or territory, an 
Indian tribe, or a foreign government, or 
a person or entity acting under a grant 
of authority from or contract with such 
public agency, including the employees 
or agents of such public agency or its 
contractors or persons or entities to 
whom it has granted authority, that is 
responsible for public health matters as 
part of its official mandate. We received 
no public comments on this definition. 


H. Research (§ ___.102(1)) 


1. Background and Pre-2018 
Requirements 


The pre-2018 rule defined “‘research” 
as a systematic investigation, including 
research development, testing, and 
evaluation, designed to develop or 
contribute to generalizable knowledge. 
Activities that met this definition 
constituted research for the purposes of 
that rule. An activity was only subject 
to that rule if it met this definition (in 
addition to meeting various other 
criteria). The pre-2018 rule also 
included categories of research 
involving human subjects that would be 
considered exempt from the rule. 

The pre-2018 rule was criticized for 
not being clear about how to interpret 
which activities were covered by the 
rule and which were not. Some 
commenters also criticized the pre-2018 
rule for extending to activities that 
should not be covered and for inhibiting 
the conduct of certain activities. 
According to some, the definition of 
“research” did not provide a sufficiently 
clear and precise way to distinguish 
between similar activities in a way that 
made it immediately obvious which 


24 Consistent with 45 CFR 164.501 in the Privacy 
Rule. 
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activities fell under the definition and 
which did not. 


2. NPRM Proposals 


The NPRM proposed creating a new 
section in the regulations referred to as 
“exclusions.” By proposing exclusion 
categories, the NPRM intended to make 
clear that these activities would not 
have to satisfy the regulatory 
requirements of the Common Rule. That 
is, the proposed excluded activities 
would have been outside the scope of 
the Common Rule. 

Three of the proposed exclusions 
sought to reduce uncertainty about 
whether certain internal program 
improvement activities, historical or 
journalistic inquiries, or quality 
assurance or improvement activities 
satisfied the Common Rule’s definition 
of research. 

Another three proposed exclusions 
pertained to activities that are part of 
inherently governmental functions with 
purposes other than research, such as 
responsibilities to protect public health 
and welfare (i.e., criminal 
investigations, public health 
surveillance, and national security 
missions). It was proposed that these 
activities promote recognized specific 
goods that are crucial to the public 
welfare. 

An additional four categories of 
proposed exclusions included human 
subjects research activities that were 
either considered low risk, or for which 
there were appropriate safeguards 
already in place independent of the 
Common Rule. These four categories 
pertained to: (1) Research that involves 
the use of educational tests, survey 
procedures, interview procedures, or 
observation of public behavior 
uninfluenced by the investigators; (2) 
research involving the collection or 
study of information that has been or 
will be acquired solely for non-research 
activities or were acquired for research 
studies other than the proposed research 
study; (3) research conducted by a 
federal government agency using federal 
government-generated non-research 
information when certain criteria are 
met; and (4) research regulated as 
“health care operations,” “public health 
activities,” or “research”? under HIPAA. 
As noted in the NPRM, in these 
categories the principle of beneficence 
alone could support the conduct of 
these activities after considering the 
level of risk, potential benefits, and 
nature of human participation in these 
activities, without the need to add the 
protections of the Common Rule. 

A final proposed exclusion would 
have applied to research involving the 
secondary use of nonidentified 


biospecimens when the research was 
limited to generating information about 
the subject that is already known by the 
subject (e.g., disease diagnosis). As 
such, this research would not need any 
additional protections provided by these 
regulations. This proposed exclusion 
was directly related to the proposed 
changes in the definition of ‘““human 
subject” to include all biospecimens, 
regardless of whether they are 
identifiable (as discussed above in 
Section III, that proposal has not been 
adopted). 


3. Public Comments, Response to 
Comments, and Description of the Final 
Rule: Definition of Research 


a. Overview 


Approximately 375 public comments 
discussed at least one aspect of the 
proposed NPRM exclusions. General 
concerns about the exclusions included 
that they added a layer of unnecessary 
complexity in determining what studies 
fall under the Common Rule, and that 
overlapping categories of exclusions and 
exemptions were proposed. Comments 
also expressed the concern about the 
lack of requirements on who would 
decide whether an activity met the 
criteria for an exclusion, including 
investigators, or whether those 
decisions would be documented in any 
way. 

In response to the public comments, 
the NPRM’s general approach of 
designating various categories of 
activities as excluded has not been 
adopted. Instead, the final rule reverts to 
the general structure of the pre-2018 
rule and integrates some of the 
categories proposed for exclusion in the 
NPRM into that structure, with some 
changes to the categories. 


The final rule retains the wording of 
the pre-2018 definition of research, and 
explicitly removes four categories of 
activities from activities that would 
meet that definition. These revisions are 
intended to make the rule simpler, more 
familiar to readers who are aware of the 
pre-2018 rule and its definition of 
research, and easier to understand. 


The four categories of activities 
removed from the definition of research 
are set out in order to make clear that 
they are not within the jurisdiction of 
the rule. The four categories pertain to 
certain scholarly and journalistic 
activities, public health surveillance 
activities, criminal justice activities, and 
authorized operational activities in 
support of national security missions. 
These categories were proposed as 
exclusions in the NPRM; the final rule 
retains these categories, with some 


changes made in the wording for clarity, 
in response to public comments. 

The category of certain scholarly or 
journalistic activities is removed from 
the definition in order to resolve long- 
standing debate and uncertainty about 
whether these activities are considered 
research in the sense of the regulatory 
definition. We believe that these 
activities should not be considered 
research in the context of the Common 
Rule, and that making this explicit in 
the final rule will help to resolve the 
uncertainty. 

The final rule includes a simpler 
definition of national security missions 
not considered to be human subject 
research, as a response to concern that 
the earlier draft language in the NPRM 
could be interpreted too broadly or too 
narrowly due to the specific activities 
listed, such as surveys, interviews, 
surveillance activities and related 
analyses, and the collection and use of 
biospecimens. These authorized 
operational activities, as determined by 
each agency, do not include research 
activities as defined by the Common 
Rule, nor have they ever in the past 
been considered regulated by the 
Common Rule. This category of activity 
is removed from the definition of 
research to make explicit that the 
requirements of the final rule do not 
apply to authorized operational 
activities in support of national security 
missions. 

The other two categories of activities 
deemed not to be research under the 
final rule (pertaining to public health 
surveillance activities and criminal 
justice activities) include many 
activities that under the pre-2018 rule 
do not fit the definition of research, and 
some activities that otherwise might. 
These categories are included in the 
final rule in order to make it explicit 
that the requirements of the final rule do 
not apply to them. 

Three categories of activities proposed 
as exclusions have been eliminated from 
the final rule. The proposed exclusion 
for certain quality assurance/quality 
improvement (QA/QJ) activities has 
been dropped because it could create 
more confusion than it resolved, and it 
might have inadvertently created 
inappropriate obstacles to those QA/QI 
activities that should not fall under the 
rule. The proposed exclusion for 
internal program improvement activities 
has been dropped due to similar 
considerations. The category regarding 
secondary research involving 
nonidentified biospecimens designed 
only to generate information about an 
individual that is already known has 
been dropped because it is no longer 
necessary given that the NPRM proposal 
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to modify the definition of human 
subject to include all biospecimens 
regardless of identifiability is not 
included in the final rule. The 
discussion of the proposed exclusion for 
certain research activities with 
nonidentified biospecimens appears in 
additional detail in Section ILD. 

The four exclusions proposed in the 
NPRM that are incorporated into the 
exemptions in the final rule are: (1) The 
proposed exclusion for certain 
educational tests, survey or interview 
procedures or observation of public 
behavior; (2) the proposed exclusion for 
secondary research use of information 
that is publicly available or recorded 
without identifiers; (3) the proposed 
exclusion regarding secondary research 
use of information collected by the 
Federal Government for other purposes 
and subject to certain privacy laws; and 
(4) the proposed exclusion regarding 
secondary research use of information 
covered by HIPAA protections. 


b. Scholarly and Journalistic Activities 
(e.g., Oral History, Journalism, 
Biography, Literary Criticism, Legal 
Research, and Historical Scholarship) 
(§___.102(1)(1)) 


i. Public Comments 


Approximately 50 comments 
discussed the NPRM proposal to 
exclude scholarly and journalistic 
articles from coverage by the rule. The 
majority of these comments supported 
the intent of the exclusion, although 
several comments suggested possible 
changes. The minority of the comments 
expressed concerns. Those who 
opposed this exclusion generally 
opposed all exclusions, arguing that 
investigators should be required to get 
permission from subjects before 
engaging in these activities. 

One commenter expressed concern 
about an exclusion that would permit 
oral history activities with tribal nations 
without oversight. This commenter 
noted that some oral history with tribal 
nations is tantamount to cultural 
appropriation, and the concern of tribal 
nations might not be adequately 
protected by the ethical standards of 
various professions. 

Several commenters discussed that 
the wording of the NPRM regulatory text 
here might be more restrictive than 
necessary. Specifically, several 
commenters noted that in calling out 
specific disciplines and methodologies, 
the regulatory text seems counter to the 
NPRM policy goal of allowing this type 
of research (as opposed to research in 
these specific fields) to occur. 

A few commenters discussed the need 
for ethnographic research to be 


explicitly called out in this exclusion. 
One commenter also raised cultural 
anthropology as another academic 
discipline that should be referenced in 
this exclusion. 


Several commenters, including 
academic discipline advocacy groups, 
noted that the exclusion conflated broad 
disciplines (journalism) with 
methodologies (oral history), which 
could be confusing to those attempting 
to implement the exclusion. 


Several commenters also questioned 
whether the provision ‘‘that focus 
directly on the specific individuals 
about whom the information is 
collected” applied only to historical 
scholarship activities or to all of the 
activities and disciplines noted in the 
exclusion. Several other commenters 
indicated that they supported a full 
exclusion of all oral history, journalism, 
biographical, and historical scholarship 
activities, suggesting that those several 
individuals do not presume that the 
provision “‘that focus directly on the 
specific individuals about whom the 
information is collected” served as a 
limitation on what activities were 
covered under this exclusion. 


A minority of commenters—including 
accreditation bodies, human research 
protection experts, and research 
universities—suggested that an 
exclusion for these activities was not 
needed, and that this topic could be 
addressed through guidance. These 
comments also indicated that 
addressing this topic in guidance might 
be clearer to the regulated community as 
well. Others indicated that the 
exclusion is not warranted because the 
excluded activities are those that would 
not contribute to generalizable 
knowledge and thus already would not 
fall under the rule. 


The NPRM also asked whether 
biospecimens should be included in this 
exclusion. Very few individuals 
answered this question, and those that 
did indicated that biospecimens should 
not be included. 


One research university indicated that 
with respect to oral history, the 
exclusion should make a distinction 
between oral history projects that meet 
the definition of research and those that 
do not, suggesting that the exclusion 
should not exempt all projects that 
might fall under the ‘“‘oral history” 
banner. One commenter noted that oral 
history should be defined in order to 
distinguish that activity from 
interviews. 


ii. Response to Comments and 
Explanation of the Final Rule: Scholarly 
and Journalistic Activities 


The final rule explicitly removes a 
category of activities consisting of 
certain scholarly and journalistic 
activities from the definition of research 
and the scope of the regulations. This 
category of activities concerns certain 
activities in various fields that focus 
directly on the specific individuals 
about whom information are collected. 
As described above, this category is 
removed from the definition in order to 
resolve long-standing debate and 
uncertainty about whether these 
activities are considered research in the 
sense of the regulatory definition. We 
believe that these activities should not 
be considered research in the context of 
the Common Rule, and that making this 
explicit in the final rule will help to 
resolve the uncertainty. 

In these activities, the ethical 
requirement is to provide an accurate 
and evidence-based portrayal of the 
individuals involved, and not 
necessarily to protect them from public 
scrutiny. For example, a biographer 
might collect and present factual 
information to support the biographer’s 
opinion about the character of an 
individual to show that the individual 
does not deserve the positive reputation 
he or she enjoys in society. These fields 
of research have their own codes of 
ethics, according to which, for example, 
consent is obtained for oral histories. 
We note that this consent standard 
should address the issue of oral 
histories of tribal members. For these 
reasons, we have determined that it is 
appropriate to remove these activities 
from the definition of research and from 
the scope of the Common Rule. 

In response to public comments, 

§ _.102(1)(1) refers to more fields and 
methodological traditions than were 
proposed in the NPRM. The final rule 
also explicitly cites those fields and 
traditions as examples, in order to 
clarify that the focus is on the specific 
activities that collect and use 
information about specific individuals 
themselves, and not generalizing to 
other individuals, and that such 
activities occur in various fields of 
inquiry and methodological traditions. 
Literary criticism has been added as an 
example because while a piece of 
literary criticism might focus on 
information about the author(s), it 
would typically focus on the specific 
author(s) in view. Legal research has 
been added as an example because it 
would often focus on the circumstances 
of specific plaintiffs or parties involved 
in a case. It is not the particular field 
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that removes the activity from the 
definition, but rather the particular 
activity’s focus on specific individuals. 

Activities described in § _.102(1)(1) 
may sometimes be performed in the 
fields of anthropology or sociology, but 
not all activities characteristic of these 
fields are outside of the rule. Studies 
using methods such as participant 
observation and ethnographic studies, 
in which investigators gather 
information from individuals in order to 
understand their beliefs, customs, and 
practices, and the findings apply to the 
studied community or group, and not 
just the individuals from whom the 
information was obtained, fall within 
the scope of the definition of research of 
the final rule. 


c. Public Health Surveillance 
(§ .102(1)(2)) 


i. Public Comments 


Approximately 80 comments 
discussed the proposed exclusion for 
certain public health surveillance 
activities. Public comments were 
generally mixed with many comments 
suggesting that the regulated community 
will need to see additional examples of 
activities that satisfy this exclusion and 
activities that fall outside its scope. 
Those who supported this exclusion 
generally said that this would 
streamline important public health 
surveillance activities. 

Several comments discussed the 
importance of this exclusion with 
respect to residual newborn DBS 
screening programs. These comments 
generally expressed the opinion that 
most state mandated public health 
reporting of such program activities 
would fall under this exclusion. 
Commenters requested additional 
explanation of what aspects of these 
state newborn screening programs 
would be covered under this exclusion, 
and listed components of the program 
that should be covered, including 
validity testing and test development. 
Others suggested that this exclusion 
should also exclude minimal risk efforts 
to evaluate surveillance methods. 
Others suggested that this exclusion 
should also exclude minimal risk efforts 
to evaluate surveillance methods. 
Another comment suggested that a final 
rule address, in this exclusion or 
elsewhere, the issue of research that 
must be conducted during public health 
emergencies, citing the example of 
HHS’s emergency use provision with a 
waiver of informed consent, which 
describes limited circumstances in 
which a patient is physically 
incapacitated or otherwise unable to 
give consent. 


Those who opposed excluding these 
activities argued that in some cases, 
research activities for which informed 
consent should be sought and obtained 
are sometimes conducted under the 
auspices of public health surveillance; 
the importance of the activity itself 
should not be an argument to avoid 
seeking and obtaining consent. Others 
argued that consent should always be 
sought and obtained for research 
activities and that all of the exemptions 
and exclusions discussed in the NPRM 
should be covered activities. One 
institution indicated that this exclusion 
was simply not needed because the 
activities described did not meet the 
definition of “research” and thus were 
not subject to the Common Rule. 

Another commenter indicated that 
while the intent of the exclusion seemed 
reasonable, implementation of the 
regulatory intent would be difficult, and 
there are many examples of modern 
public health surveillance activities 
where informed consent would have 
been appropriate. 

A few comments that opposed the 
exclusion indicated concern that it 
might be abused, and cited the Tuskegee 
Syphilis study 25 as an example of what 
they feared might be included under 
this exclusion category. We do not think 
that study would fall within this 
category, because it involved research 
interventions with the subjects, 
including the provision of substandard 
treatment and efforts to prevent subjects 
from obtaining effective treatment, 
which under no circumstances could be 
considered surveillance about a 
condition of public health importance. 


25 The Tuskegee Syphilis study “‘initially 
involved 600 black men—399 with syphilis, 201 
who did not have the disease. The study was 
conducted without the benefit of patients’ informed 
consent. Researchers told the men they were being 
treated for ‘bad blood,’ a local term used to describe 
several ailments, including syphilis, anemia, and 
fatigue. In truth, they did not receive the proper 
treatment needed to cure their illness. In exchange 
for taking part in the study, the men received free 
medical exams, free meals, and burial insurance. 
Although originally projected to last 6 months, the 
study actually went on for 40 years. 

The [federal government panel investigating this 
study] found that the men had agreed freely to be 
examined and treated. However, there was no 
evidence that researchers had informed them of the 
study or its real purpose. In fact, the men had been 
misled and had not been given all the facts required 
to provide informed consent. . . The men were 
never given adequate treatment for their disease. 
Even when penicillin became the drug of choice for 
syphilis in 1947, researchers did not offer it to the 
subjects. The advisory panel [investigating this 
study] found nothing to show that subjects were 
ever given the choice of quitting the study, even 
when this new, highly effective treatment became 
widely used.” Source: “The Tuskegee Timeline.” 
Centers for Disease Control and Prevention, last 
updated 19 Feb 2016. Retrieved from http:// 
www.cdc.gov/tuskegee/timeline.htm.) 


The NPRM asked whether the 
parameters of this exclusion were 
sufficiently clear, and if not, how the 
exclusion could be clarified. In 
response, one private organization 
conducting public health research stated 
that it was unclear if this only applies 
to governmental entities like the Centers 
for Disease Control and Prevention 
(CDC), or if it applies to other 
organizations as well. Another 
institution suggested that the 
community needed additional 
clarification of what types of activities 
fall under this exclusion. One research 
university requested clarification on 
whether public health surveillance 
activities falling under this exclusion is 
subject to subpart B and C, that is, 
research involving pregnant women or 
prisoners, respectively. One 
organization indicated that it would be 
helpful for the examples used in the 
NPRM preamble to be published as a 
separate guidance document. 


Another comment noted that the 
examples included in the preamble only 
addressed acute infectious disease 
surveillance and no other types of 
public health surveillance activities, 
specifically, chronic disease 
surveillance and biomonitoring for toxic 
chemical compounds and metabolites, 
which should be covered under this 
exclusion. 


Another research organization noted 
that the regulatory text and examples 
provided might be too narrow, 
suggesting the exclusion be broadened 
to clarify that it applies to public health 
monitoring aimed at evaluating the 
degree to which affected individuals 
seek and obtain treatment, barriers to 
care, quality of care, treatment 
outcomes, and health disparities. 


Commenters also requested additional 
explanation of what aspects of state 
newborn screening programs would be 
covered under this exclusion, and listed 
a variety of components of the program, 
including validity testing and 
development of new tests, that should 
be covered by the exclusion. 
Commenters asked that clarification of 
the parameters of the public health 
exclusion be provided so that state 
newborn screening programs can 
undertake the activities necessary for 
new test development. They added that 
if the parameters are not clarified, given 
the past controversies associated with 
the retention and secondary use of 
newborn DBS, many programs may not 
undertake activities for which they have 
not been given express permission to 
pursue. 
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ii. Response to Comments and 
Explanation of the Final Rule: Public 
Health Surveillance 


The final rule adopts the NPRM 
proposal related to deeming certain 
public health surveillance activities as 
explicitly outside of the scope of the 
Common Rule. Several editorial 
modifications have been made to this 
category to improve readability. 
Additionally, the final rule explicitly 
specifies that the collection of 
information is permitted under this 
category of activities. 

The final rule codifies the current 
interpretation that the definition of 
research does not include a category of 
activities that solely involve public 
health surveillance, including collecting 
and testing information or biospecimens 
in activities that are conducted, 
supported, requested, ordered, required, 
or authorized by a public health 
authority and that are limited to those 
necessary to allow the public health 
authority to identify, monitor, assess, or 
investigate potential public health 
signals, onsets of disease outbreaks, or 
conditions of public health importance. 
Such surveillance activities can include 
collecting information about trends, 
signals, risk factors, patterns in diseases, 
or increases in injuries from using 
consumer products. Such activities 
include those associated with providing 
timely situational awareness and 
priority-setting during the course of an 
event or crisis that threatens public 
health, including natural or man-made 
disasters. 

This codification of public health 
surveillance activities as outside the 
definition of research is designed to 
remove uncertainty, but is not intended 
to change the scope of activities subject 
to or not subject to the Common Rule. 
When a public health authority 
conducts public health surveillance 
activities to fulfill its legal mandate to 
protect and maintain the health and 
welfare of the populations it oversees, 
the regulatory protections of the 
Common Rule should not impede that 
authority’s ability to accomplish its 
mandated mission of promoting this 
recognized public good, in keeping with 
the principle of beneficence. Other 
protections independent of the Common 
Rule exist that serve to protect the rights 
and welfare of individuals participating 
in such activities, including federal and 
state policies to protect privacy, 
confidentiality, and security safeguards 
for the information collected. 

Public health surveillance refers to 
collecting, analyzing, and using data to 
target public health and disease 
prevention. It is the foundation of 


public health practice. Surveillance uses 
data from a variety of sources, including 
mandatory reporting of certain 
conditions, routine monitoring, vital 
records, medical billing records, and 
public health investigations. The line 
between public health surveillance and 
epidemiological research can be 
difficult to draw, as the same 
epidemiological techniques may be used 
in both. Generally, the difference 
between the activities is the purpose or 
context in which the investigation is 
being conducted and the role of the 
public health authority. 

The following are examples of public 
health surveillance activities being 
codified as outside of the definition of 
research in this regulation: 

e Safety and injury surveillance 
activities designed to enable a public 
health authority to identify, monitor, 
assess, and investigate potential safety 
signals for a specific product or class of 
products (for example, the surveillance 
activities of the FDA’s Adverse Event 
Reporting System,?6 the Vaccine 
Adverse Event Reporting System,?7 
Manufacturer and User Facility Device 
Experience database,?® the Medical 
Product Safety Network,29 and the 
Sentinel Initiative); 3° 

e Surveillance activities designed to 
enable a public health authority to 
identify unexpected changes in the 
incidence or prevalence of a certain 
disease in a defined geographic region 
where specific public health concerns 
have been raised (e.g., the U.S. influenza 
surveillance system, which allows CDC 
to find out when and where influenza 
activity is occurring, track influenza- 
related illness, determine what strains 
of influenza virus are circulating, detect 
changes in influenza viruses, and 
measure the impact influenza is having 
on hospitalizations and deaths in the 
United States); 

e Surveillance activities designed to 
enable a public health authority to 
identify the prevalence of known risk 
factors associated with a health problem 
in the context of a domestic or 
international public health emergency; 

e Surveillance activities designed to 
enable a public health authority to 
locate the range and source of a disease 
outbreak or to identify cases of a disease 
outbreak; 


26 See hitp://www.fda.gov/Drugs/ 
InformationOnDrugs/ucm135151.htm. 

27 See https://vaers.hhs.gov/index. 

28 See hitp://www.fda.gov/MedicalDevices/ 
DeviceRegulationandGuidance/ 
PostmarketRequirements/ReportingAdverseEvents/ 
ucm127891.htm. 

29 See hitp://www.fda.gov/MedicalDevices/Safety/ 
MedSunMedicalProductSafetyNetwork/. 

30 See hitp://www.fda.gov/Safety/FDAsSentinel 
Initiative/ucm2007250.htm. 


e Surveillance activities designed to 
enable a public health authority to 
detect the onset of disease outbreaks or 
provide timely situational awareness 
during the course of an event or crisis 
that threatens the public health, such as 
a natural or man-made disaster; and, 

e Surveillance activities designed to 
enable a public health authority to 
identify the prevalence of a condition of 
public health importance, known risk 
factors associated with a condition of 
public health importance, or behaviors 
or medical practices related to 
prevalence of a known condition of 
public health importance (e.g., 
surveillance of the prevalence of: 
tobacco use, exposure to secondhand 
smoke, lung cancer, or use of smoking 
cessation treatments). 

On the other hand, subsequent 
research using information collected 
during a public health surveillance 
activity, for instance, genetic analysis of 
biospecimens, would not be removed 
from the definition. 

This clarification of current 
interpretation would not remove the 
following activities from the definition 
of ‘‘research’’: exploratory studies 
designed to better understand risk 
factors for chronic diseases, including 
genetic predisposition, for chronic 
diseases; exploratory studies designed 
to elucidate the relationships between 
biomarkers of exposure and biomarkers 
of disease; and exploratory studies of 
potential relationships between 
behavioral factors (e.g., diet) and 
indicators of environmental exposures. 
These types of activities would be 
considered research because they would 
not be conducted solely for the purposes 
described in § _.102(1)(2), and thus 
would be covered by the Common Rule 
if they involved human subjects, even if 
conducted by a federal agency with a 
public health mandate. Again, they 
might fall within an exemption, 
depending on how they are carried out. 

We note that this provision does 
apply to some activities responding to 
emergencies, and that various 
department or agency activities, not just 
those of HHS, will be affected. Research 
evaluations of public health 
surveillance activities are not included 
in this category because the nature of 
such evaluations is to create 
generalizable knowledge. We also 
recognize that in some public health 
surveillance activities, it may be 
appropriate to obtain consent from the 
individuals from whom information or 
biospecimens are collected. 

We recognize the public comments 
stating that the boundaries of public 
health surveillance activities being 
removed from the definition of research 
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are not entirely clear. We recognize that 
some of the activities in this category 
are not research, but believe that the 
inclusion of this provision will help to 
resolve uncertainty in some 
circumstances about whether the rule 
applies. We believe that developing 
guidance in this area will be useful. 
Finally, to clarify what public health 
surveillance activities are being 
removed from the definition of research, 
the final rule contains a new definition 
of ‘‘public health authority” at 
§ _.102(k). 


d. Criminal Justice Activities 
(§__.102(1)(3)) and Authorized 
Operational Activities in Support of 
National Security Missions 


(§___-.102(1)(4)) 
i. Public Comments 


Approximately 60 comments 
discussed the exclusion for certain 
criminal justice activities, the exclusion 
for intelligence surveillance activities, 
or both. The majority of commenters 
opposed these provisions. 

Several commenters stated that the 
two exclusions seemed to contradict 
President Clinton’s Memorandum of 
1997, which stated that classified 
research activities are subject to the 
Common Rule and directed that the 
regulations be revised to include certain 
protections specific to classified 
research activities.31 

The majority of commenters 
discussing these provisions also 
expressed concern about what appeared 
to be an expansion of activities not 
covered by the Common Rule. These 
commenters also discussed concerns 
about how this exclusion would affect 
human subjects protections in classified 
research activities. 

Those who supported these 
exclusions generally did not provide the 
rationale for why they supported them. 

One research organization noted that 
additional clarification on the exclusion 
for certain criminal justice activities 
would be needed, and noted that such 
activities should continue to be subject 
to the Common Rule because this type 
of research often includes the collection 
of sensitive, identifiable information, 
which, if disclosed could present risks 
to the subjects. 


ii. Response to Comments and 
Explanation of the Final Rule: Criminal 
Justice Activities 


The final rule clarifies that, consistent 
with current practice, data collection 


31 Memorandum of March 27, 1997. Strengthened 
Protections for Human Subjects of Classified 
Research. 62 FR 26367 (May 13, 1997). Retrieved 
from hittp://www.fas.org/sgp/clinton/humexp.html. 


and analysis that enables the conduct of 
certain activities carried out as part of 
the criminal justice system is not 
research. The scope of these activities is 
collection and analysis of information, 
biospecimens, or records by or for a 
criminal justice agency for activities 
authorized by law or court order solely 
for criminal justice or criminal 
investigative purposes. The activities 
are necessary for the operation and 
implementation of the criminal justice 
system. The final rule changes the 
wording of the category from that 
proposed in the NPRM only by 
substituting the word “information” for 
“data,” for consistency with other parts 
of the rule. 


The provision essentially codifies 
current federal interpretation that such 
activities are not considered to be 
research under the Common Rule. 
Revising the regulations to explicitly 
remove such activities from the scope of 
research subject to the rule is designed 
to avoid the imposition of disparate 
requirements by IRBs with overlapping 
jurisdictions when information 
collection or analysis encompasses the 
development of methods required by 
law or court order for criminal justice or 
criminal investigative purposes. For 
example, the Federal Bureau of 
Investigation (FBI) is charged by law 
with setting standards governing the 
collection and processing of DNA 
biospecimens and information taken 
(forcibly if necessary) from certain 
federal and state criminal suspects or 
offenders incident to their arrest or 
conviction for prescribed offenses under 
the National DNA Identification Act of 
1994 and other acts. Similarly, the FBI 
is charged by law with setting standards 
governing the collection and processing 
of fingerprints and related biographical 
information taken from federal and state 
criminal suspects or offenders and 
certain sensitive civil employment 
applicants. Many criminal law 
enforcement agencies routinely collect 
human biospecimens at crime scenes 
from or relating to victims, suspects, 
and offenders both known and 
unknown. Incident to these activities, 
the FBI is also charged with 
maintaining, and authenticating through 
identification processes, the criminal 
record history of criminal offenders for 
federal government agencies and for the 
overwhelming majority of state 
governments that elect to participate 
and share information through those 
systems. We have determined that this 
category of activities does not meet the 
definition of research in the final rule, 
so that these activities can be conducted 


in accordance with the legitimate goals 
of the criminal justice system. 


We do not believe that this provision 
contradicts President Clinton’s 1997 
memorandum, which addressed the 
regulatory requirements for certain 
activities that are considered research 
under the regulations. This category 
pertains to activities that are outside of 
the regulatory requirements. 


This category is also not intended to 
include social and behavioral studies of 
the causes of criminal behavior. Such 
studies would be considered research 
under the final rule. 


iii. Response to Comments and 
Explanation of the Final Rule: 
Authorized Operational Activities in 
Support of National Security Missions 


The final rule clarifies current federal 
practice that the definition of research 
does not include authorized operational 
activities (as determined by each 
agency) in support of intelligence, 
homeland security, defense, or other 
national security missions. This 
clarification codifies the interpretation 
of the pre-2018 Common Rule. 


As described above, the final rule 
includes a simpler reference to 
authorized operational activities in 
support of national security missions 
not considered to be human subject 
research, as a response to concern that 
the NPRM proposal could be interpreted 
too broadly or too narrowly due to the 
specific activities listed, such as 
surveys, interviews, surveillance 
activities and related analyses, and the 
collection and use of biospecimens. 
These authorized operational activities, 
as determined by each agency, do not 
include research activities as defined by 
the Common Rule, nor have they ever in 
the past been considered regulated by 
the Common Rule. This category of 
activity is removed from the definition 
of research to make explicit that the 
requirements of the final rule do not 
apply to authorized operational 
activities in support of national security 
missions. This clarification is not 
intended to narrow the scope of the 
Common Rule. 


We do not believe that this category 
contradicts President Clinton’s 
Memorandum of 1997 regarding 
classified research, because this 
category is merely clarifying what 
activities are not considered to meet the 
definition of research. The Clinton 
Memorandum calls for a number of 
requirements to be added to protections 
for classified research activities, but it 
does not address activities that are not 
considered research. 
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4. NPRM Exclusions Not Included in the 
Final Rule 


a. Certain Quality Assurance and 
Quality Improvement Activities 


i. Public Comments 


Approximately 90 comments 
discussed the proposed exclusion for 
certain QA/QI activities in the NPRM 
involving the implementation of an 
accepted practice. A majority of 
comments supported the concept of 
excluding some QA/QI activities from 
the Common Rule, although some stated 
that the QA/QI exclusion proposed in 
the NPRM was too narrow to cover what 
has evolved as current practice. 

These commenters expressed 
concerns that: (1) The NPRM proposed 
to exclude only the QA/QI activities that 
met the exclusion, and that all other 
QA/QI activities would fall under the 
rule; or (2) the exclusion would be 
interpreted to mean that the activities 
described in the exclusion were the only 
QA/QI activities that could be 
considered not covered by the rule. 

The most commonly discussed 
suggestions for expanding the scope of 
this exclusion included: 

e Expanding the exclusion beyond 
“accepted practices” 

e Permitting the collection of 
outcome measures in the category of 
activities proposed to be excluded by 
the NPRM 


One hospital noted that QA/QI is not 
limited to implementation of an 
“accepted practice’’ and that limiting 
the exclusion in this way might impede 
innovation, for example, accessing an 
electronic medical record system for 
QA/QI to test incorporating clinical 
information to analyze and test best- 
practice pop-up alerts that signal 
important information for healthcare 
providers in caring for a patient. This 
commenter asserted that there is no 
current ‘“‘accepted practice”’ for 
activities like this, yet they should be 
excluded from the definition of research 
to avoid confusion and to support 
ongoing innovation and care 
improvement activities. This commenter 
also suggested that any QA/QI exclusion 
should permit activities that allow 
medical centers to analyze how they 
deliver care, improve outcomes, and 
modify processes to achieve healthcare 
reform goals. 

One commenter also noted that the 
“accepted practice’ limitation would 
also be problematic in the social 
sciences. This commenter disagreed that 
the proposed exclusion for quality 
improvement or assurance practices 
should be limited to ‘‘an accepted 
practice,” and felt that it should apply 


to the evaluation of alternative 
practices. In social sciences research an 
“accepted practice’’ is generally not as 
well defined, can evolve rapidly, and 
vary by considerations such as timing, 
culture, geography, and nature of 
service. In social science research, this 
limitation could severely limit the use 
of this exclusion for research that is 
equally low in risk and therefore does 
not require review. 

A few commenters explicitly 
referenced the importance of QA/QI 
activities in the context of a learning 
health care system, and discussed the 
need for a broader exclusion in order to 
achieve the goals of a learning health 
system. 

A professional organization focused 
on advancing the fields of health 
services research and health policy 
noted that a basic tenet of the learning 
health system is the expectation of 
continuous learning from routine care, 
which often is accomplished by 
evaluating health outcomes. The 
intentional assessment of the outcomes 
related to a QI activity by itself should 
not make the activity subject to the 
Common Rule. 

A medical education membership 
organization felt that routine evaluation 
of practices and continuous 
incorporation of knowledge learned into 
patient care is fundamental to a learning 
health system and should not be 
impeded by the regulatory framework. It 
stated that the current Common Rule 
provides insufficient guidance to 
distinguish research and improvement 
in care delivery in a consistent manner. 
The organization indicated that the 
revised Common Rule explicitly 
recognizes that efforts to improve care 
by evaluating an accepted practice and 
the resulting effects are not research that 
should be regulated under the Common 
Rule. 

Commenters suggested many other 
QA/QI activities that should be 
explicitly excluded or exempted from 
the Common Rule, such as: 

e Activities mandated by the Clinical 
Laboratory Improvement Amendments 
(CLIA) 

e Evaluations of systems-level 
interventions to improve quality and 
safety 

e Comparative assessment of 
alternative practices to determine 
relative effectiveness 

e All QA/QI research for the purpose 
of health care operations, including 
patient-centered comparative 
effectiveness research 

e Evaluation of competing QA/QI 
strategies for implementation of 
accepted medical practices, which 
should not be subject to IRB review 


e Evaluation of competing low-risk 
interventions that would typically be 
implemented in a QA/QI framework 
without further research: these typically 
are not direct medical treatments but 
ancillary aspects of care. 

e The use of other analytic 
assessment methods, such as 
interrupted time series analysis, or 
randomization of clusters (including 
stepped wedge designs) 

e Dissemination of QA/QI results, or 
the intention to disseminate results, 
including by publication, which should 
not by itself make the activity subject to 
IRB review (consistent with current 
OHRP guidance) 

e Multi-institution collaborations of 
otherwise routine QA/QI activities 

e Public health-related QA/QI 
activities 

¢ Comparative benchmarking 

Others expressed approval for the 
proposed exclusion, but suggested that 
substantial guidance would be 
necessary for the regulated community 
to apply this exclusion appropriately. 
Specifically, several commenters asked 
about the extent to which OHRP’s 
current guidance on QA/QI activities 
would still apply. Others asked for 
clarification about the extent to which 
the NPRM proposal would apply in 
situations where a hospital system with 
several hospitals implemented different 
accepted practices at different hospitals 
within the system, and compared 
outcomes to determine which accepted 
practice would be best for that hospital 
system. 

Several comments did not support the 
NPRM’s QA/QI proposal. Reasons 
included: believing that the activities 
excluded by the NPRM already did not 
meet the definition of research and thus 
did not need to be explicitly excluded; 
believing that these activities should be 
subject to some type of review because 
of concerns about investigator self- 
determination; and, believing that even 
in QA/QI activities, human subjects 
should be offered the opportunity to 
know that they are subjects in a research 
activity and should be offered the 
option to consent. 

One patient advocacy group noted 
that because much research is done in 
the guise of administration or QI, this 
proposed exclusion might encourage 
researchers to evade human subjects 
protections while the projects may put 
primary subjects and third parties at 
risk. It stated that although some 
hospital-based projects might incur 
minimal risk to primary subjects, they 
might pose greater risk to other parties, 
for example, patients. Thus, the group 
argued that this exclusion should be 
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stricken and that if personal information 
and biospecimens are to be collected 
and analyzed for purposes other than 
the individual patient’s care, then that 
activity should be subject to the 
Common Rule. 

One research institution felt that the 
proposed change suggests that patient 
consent will be necessary for many 
activities designed to ensure QA/QI in 
health care settings, and could interfere 
with the imperative to design and 
evaluate new approaches to enhance 
patient safety and clinical outcomes. 
The commenter added that the 
implications of this provision should be 
assessed by clinical practitioners and 
hospital administrators in addition to 
researchers and research institutions. 

Another commenter noted that the 
proposed exclusion of QA/QI activities 
fails to exclude important activities that 
are considered ‘‘not research” under the 
current Common Rule, arguing that the 
new NPRM exclusion is more in line 
with evidence-based practice than with 
QI. Institutions are required under The 
Joint Commission to perform 
continuous QI activities, which 
typically are small, iterative changes to 
improve clinical care; these activities 
are seen as part of hospital operations 
rather than research. The commenter 
stated that the proposed limitations 
would make certain QI activities subject 
to IRB review and possible informed 
consent requirements, which could 
result in overregulating an activity that 
is currently not subject to the Common 
Rule. 

Several of these commenters generally 
indicated that they interpreted the 
proposed exclusion as providing a 
definition of QA/QI, as opposed to 
excluding a specific type of QA/QI 
activity. Several of these commenters 
suggested deleting a QA/QI exclusion 
from the rule so that IRBs and 
investigators would not be confused. 
One hospital suggested eliminating 
quality activities from the NPRM since 
by specifying that certain quality 
activities are not research, the NPRM 
seems to designate all other quality 
activities as research by default. 


ii. Response to Comments and 
Explanation of the Final Rule: Certain 
Quality Assurance and Quality 
Improvement Activities 


The proposed exclusion for QA/QI 
activities is not included in the final 
rule. The degree of concern expressed 
by the public comments on this topic is 
significant. We recognize that human 
subject protections would be 
meaningful and appropriate for some 
QA/QI research activities, but not for 
others. However, to avoid increasing 


confusion and unnecessary obstacles to 
innovation, the final rule does not single 
out certain QA/QI activities as meeting 
or not meeting the definition of 
research. 


b. Program Improvement Activities 
i. Public Comments 


Approximately 20 comments were 
received on this proposed exclusion 
regarding data collection and analysis 
for internal operational monitoring and 
program improvement purposes, with a 
strong majority in support. Commenters 
indicated that the proposed exclusion 
would require significant guidance 
because it was unclear what types of 
activities it might include and when. 
Several commenters supported the 
proposed exclusion, but noted that the 
exclusion should specifically reference 
QI activities instead of just program 
improvement activities. One commenter 
suggested that activities defined as 
“health care operations” under HIPAA 
also be included in this exclusion. One 
commenter opposed this exclusion 
because of the lack of specific reference 
to QI. Another opposed this exclusion 
because they felt it was too narrowly 
written. 

One large private research firm 
indicated opposition to this proposal 
because it was too confusing. Further, 
this group questioned the need for an 
exclusion that seemed to only reference 
activities that would not be considered 
to fall under the rule because these 
activities would not satisfy the 
definition of research (specifically, these 
activities would not be designed to 
contribute to generalizable knowledge). 

Of those who opposed this proposal, 
a minority suggested that the proposed 
exclusion could be abused by 
investigators, especially given that the 
NPRM did not propose to require any 
institutional oversight of exclusion 
determinations. One commenter noted 
that because many research activities 
might be conducted under the guise of 
internal improvement activities, this 
exclusion seemed to be giving 
investigators significant opportunities to 
conduct human research activities 
outside the confines of the rule. 

One commenter who supported this 
provision suggested that it could be 
merged with the QA/QI exclusion 
proposed in the NPRM. This commenter 
also suggested that a definition of 
program improvement and operational 
monitoring be provided. 

The NPRM asked whether the use of 
biospecimens should be permitted in 
this exclusion. Of those who answered 
this question, a majority indicated yes. 
This majority generally referenced a 


belief that many activities with residual 
newborn DBS (see Section III.D) would 
fall under this exclusion. One 
commenter who opposed the inclusion 
of biospecimens in this excluded 
category indicated that if the goal of the 
NPRM was to cover all nonidentified 
biospecimens, then this exclusion 
should not include the research use of 
biospecimens. 


ii. Response to Comments and 
Explanation of the Final Rule: Program 
Improvement Activities 


The proposed exclusion for program 
improvement activities is not included 
in the final rule. Based on the public 
comments it does not seem useful for 
this category of activities to be singled 
out as not meeting the definition of 
research. As with the NPRM proposed 
exclusion regarding QI/QA activities 
implementing accepted practices, public 
commenters raised concerns that this 
exclusion would have created more 
misunderstanding and confusion than it 
would have resolved. As with QIUQA 
activities, some program improvement 
activities involve research and deserve 
the protections of the rule, while others 
are not research and are not under the 
rule. We believe that this topic would be 
better addressed through other means. 


I. Written or in Writing (§ .102(m)) 


The final rule includes a definition 
that was not included in the NPRM nor 
in the pre-2018 rule. The definition of 
“written or in writing” is included at 
§ .102(m) to clarify that, in 
accordance with the longstanding 
interpretation of the pre-2018 rule, these 
terms include electronic formats, which 
are increasingly used to fulfill many of 
the documentation requirements that 
appear throughout the rule. 

Although public comments did not 
directly address this issue, we are aware 
that some in the regulated community 
are uncertain of whether, for example, 
consent forms may be in electronic 
formats. This definition is intended to 
address this concern. Note that the 
definition of “written or in writing”’ 
does not preclude the possibility that 
consent forms could be in media other 
than paper or electronic formats and 
still meet the requirements of the 
Common Rule. 





IV. Ensuring Compliance With This 
Policy (§ .103) 


A. Background and Pre-2018 
Requirements 


Requirements in the pre-2018 rule at 
§ _.103 delineated procedural 
requirements for institutions and IRBs 
to follow to comply with the rule. The 


7180 


Federal Register/Vol. 82, No. 12/Thursday, January 19, 2017/Rules and Regulations 








requirements pertained to written 
assurances (through FWAs) that 
institutions engaged in research are in 
compliance with the regulations and 
that the content of such assurances 
include: a statement of principles 
governing the institution in the 
discharge of its responsibilities to 
protect research subjects; designation of 
one or more IRBs; a detailed IRB 
membership roster; and written 
procedures for IRBs and reporting of 
unanticipated problems. A U.S. 
institution also was able to voluntarily 
pledge to conduct all of its nonexempt 
human subjects research, regardless of 
funding source, in compliance with the 
Common Rule or the Common Rule and 
subparts B, C, and D of 45 CFR part 46— 
often referred to as “checking the box”’ 
on the assurance form. 

The pre-2018 rule also stated who 
will execute and evaluate assurances. 
Finally, the rule described the process 
by which institutions certify that 
nonexempt research has been reviewed 
and approved by an IRB. There has been 
concern expressed by some that the 
assurance process may have been 
unduly burdensome for institutions and 
did not provide meaningful protections 
for human subjects. 


B. NPRM Proposals 


The NPRM proposed a number of 
substantive and procedural 
modifications to § .103 of the 
Common Rule. First, the NPRM 
proposed to move several requirements 
from § _-«.103to§ ~—_—.108, which 
pertains to IRB functions and 
operations: (1) The IRB recordkeeping 
requirements; (2) the requirement in the 
pre-2018 rule that IRBs have sufficient 
meeting space and staff to support IRB 
reviews and record keeping 
requirements; and (3) the pre-2018 
requirement that an up-to-date list of the 
IRB members and their qualifications be 
included in an institution’s assurance. 
The NPRM also proposed to modify the 
IRB membership requirement such that 
this up-to-date list would no longer be 
required as part of an institution’s 
assurance. Instead, an IRB or an 
institution would be required to prepare 
and maintain a current list of IRB 
members. 

The NPRM proposed to delete several 
requirements found in the pre-2018 
rule: (1) The requirement that an 
institution provide a statement of 
ethical principles by which the 
institution will abide, as part of the 
assurance process; (2) the pre-2018 rule 
requirement that an institution 
designate one or more IRBs on its FWA; 
(3) the provision found in the pre-2018 
rule that a department or agency head’s 





evaluation of an assurance will take into 
consideration the adequacy of the 
proposed IRB(s) designated under the 
assurance, in light of the anticipated 
scope of the institution’s activities and 
the types of subject populations likely to 
be involved, the appropriateness of the 
proposed initial and continuing review 
procedures in light of the probable risks, 
and the size and complexity of the 
institution; and (4) the requirement that 
grant applications undergo IRB review 
and approval for the purposes of 
certification. 

Note that under the NPRM federal 
departments or agencies would retain 
the ability to ask for information about 
which IRBs review research conducted 
at an institution as part of the assurance 
process, even if providing this 
information is not explicitly mandated. 

According to the NPRM, an 
additional, nonregulatory change was 
proposed for the assurance mechanism. 
The current option of “checking the 
box” on an FWA (described in section 
IV.A above) would be eliminated. 

To further strengthen the proposed 
new provision at § .101(a), giving 
Common Rule departments and 
agencies explicit authority to enforce 
compliance directly against IRBs that 
are not operated by an assured 
institution, language was proposed 
requiring that for nonexempt research 
involving human subjects that is 
covered by this policy and takes place 
at an institution in which IRB oversight 
is conducted by an IRB that is not 
operated by the institution, the 
institution and the organization 
operating the IRB shall establish and 
follow procedures for documenting the 
institution’s reliance on the IRB for 
oversight of the research and the 
responsibilities that each entity will 
undertake to ensure compliance with 
the requirements of this policy (e.g., a 
written agreement between the 
institution and the IRB, or by 
implementation of an institution-wide 
policy directive providing the allocation 
of responsibilities between the 
institution and an IRB that is not 
operated by the institution). 

The NPRM requested public comment 
on whether protection for human 
subjects in research would be enhanced 
if OHRP conducted routine periodic 
inspections to ensure that the 
membership of IRBs designated under 
FWAs satisfy the requirements of 
§ 107. 


C. Public Comments 





Very few comments were received on 
the proposals at § ——_—.103. Four 
commenters expressed their views on 
the proposal to delete the requirement 


that an institution provide a statement 
of ethical principles as part of the 
assurance process, with three 
supporting the proposal and one 
opposing it. 

Four commenters supported the 
proposal to eliminate the requirement 
that an institution designate one or more 
IRBs on its FWA. 

Two comments were received, one in 
support and one opposed, on the 
proposed elimination of the requirement 
that an up-to-date list of the IRB 
members and their qualifications be 
included in an institution’s assurance. 
Two comments, one for and one against, 
were received on the proposal to remove 
the requirement that a department or 
agency head’s evaluation of an 
assurance take into consideration the 
adequacy of the proposed IRBs. 
Responses to the question about 
periodic inspections to ensure IRBs 
were compliant were mixed, with most 
commenters saying that it is not clear 
that ensuring IRBs are compliant would 
enhance human subjects protections. 
Others questioned the need for this 
requirement, given other incentives 
institutions have to ensure they have a 
duly constituted IRB, and still others 
asked what was meant by “periodic.” 

Approximately 30 commenters 
supported the proposal to delete the 
requirement that the IRB review grant 
applications, with only one commenter 
opposed to the proposal. 


D. Response to Comments and 
Explanation of the Final Rule: Assuring 
Compliance With the Policy 


As proposed in the NPRM, the final 
rule eliminates the pre-2018 rule 
requirement that an institution provide 
a statement of ethical principles by 
which an institution will abide as part 
of the assurance process. We believe 
this requirement is unnecessary. 
Further, for international institutions 
that may receive federal funding for 
research activities, it creates the 
impression that these international 
institutions must modify their internal 
procedures to comport with the set of 
principles designated on the FWA for 
activities conducted at those institutions 
that receive no federal funding. OHRP 
has received many questions about the 
extent to which international 
institutions must adhere to the ethical 
principles designated as part of the 
assurance process for research activities 
conducted by the institution that receive 
no Common Rule department or agency 
funding. That such measures are not 
required will be made clear by deletion 
of this requirement in the final rule. 

Additionally, as proposed in the 
NPRM, the final rule eliminates the 
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requirement that appeared in the pre- 
2018 rule that an up-to-date list of the 
IRB members and their qualifications be 
included in an institution’s assurance. 
Instead, §§ _—.108(a)(2) and 

.115(a)(5) in the final rule require 
that an IRB or the institution prepare 
and maintain a current list of IRB 
members. This eliminates the previous 
requirement that changes in IRB 
membership be reported to the 
department or agency head, or to OHRP 
when the existence of an assurance 
approved by HHS for federal-wide use 
is accepted. Of note, SACHRP 
recommended in March, 2008 that 
OHRP pursue harmonizing the Common 
Rule with FDA’s human subjects 
protection regulations by eliminating 
the requirement to submit IRB 
membership lists. 

The final rule, as proposed in the 
NPRM, also eliminates the requirement 
that appeared in the pre-2018 rule that 
an institution designate one or more 
IRBs on its FWA. Federal departments 
or agencies retain the ability to ask for 
information about which IRBs review 
research conducted at an institution as 
part of the assurance process, even if 
that requirement is not explicitly 
mandated in the regulations. 

An additional, a nonregulatory change 
that was described in the NPRM will be 
made to the assurance mechanism. The 
prior option that enabled institutions 
with an active FWA to “check the box’”’ 
(described in section IV.A above) is 
being eliminated. Importantly, 
institutions could, if they so desire, 
continue for purposes of their own 
internal rules to voluntarily extend the 
regulations to all research conducted by 
the institution, but this voluntary 
extension will no longer be part of the 
assurance process and such research 
will not be subject to OHRP oversight. 
We expect this change to have the 
beneficial effect of encouraging some 
institutions to explore a variety of 
flexible approaches to overseeing low- 
risk research that is not funded by a 
Common Rule department or agency, 
without reducing protection of human 
subjects, thus furthering the goal to 
decrease inappropriate administrative 
burdens. 

In addition, as proposed in the NPRM, 
the final rule removes the provision 
found in the pre-2018 rule that a 
department or agency head’s evaluation 
of an assurance will take into 
consideration the adequacy of the 
proposed IRB(s) designated under the 
assurance in light of the anticipated 
scope of the institution’s activities and 
the types of subject populations likely to 
be involved, the appropriateness of the 
proposed initial and continuing review 





procedures in light of the probable risks, 
and the size and complexity of the 
institution. We believe this deletion 
aligns the regulations with changes 
made in December 2000 to OHRP’s 
implementation of the FWA process. 
Those changes streamlined and 
simplified the assurance process and 
eliminated OHRP’s institution-specific 
evaluation of the adequacy of each IRB 
designated under the assurance. 

Each FWA-holding institution 
continues to have responsibility for 
ensuring that the IRBs on which it relies 
are registered with OHRP and are 
appropriately constituted to review and 
approve the institution’s human 
subjects research, as required under 
§§ 107 and __.108 of the final 
tule. 

The final rule contains language at 
§ _.103(e) requiring that for 
nonexempt research involving human 
subjects (or exempt research that 
requires limited IRB review) that takes 
place at an institution for which an IRB 
not operated by that institution 
exercises oversight, the institution and 
the organization operating the IRB must 
document the institution’s reliance on 
the IRB for its research oversight. The 
final rule also requires that this 
documentation include the 
responsibilities of each entity to ensure 
compliance with the requirements of the 
tule. 

The requirement included in the final 
rule for documenting an institution’s 
reliance on an IRB that it does not 
operate is more flexible than what was 
proposed in the NPRM. The final rule 
only requires that the reliance 
agreement between the institution and 
the organization operating the IRB be 
documented. It does not include the 
NPRM proposal that the institution and 
the organization operating the IRB 
establish and follow procedures for 
documenting the institution’s reliance 
on the IRB for oversight of the research 
and delineating the responsibilities that 
each entity would assume to ensure 
compliance with the requirements of the 
tule. 

In considering the public comments, 
we determined that it was unnecessary 
to require that such reliance 
relationships be described in 
institutional procedures. Under the final 
rule, compliance with this provision 
could be achieved in a variety of flexible 
ways, for example, through a written 
agreement between the institution and a 
specific IRB, through language 
contained in a protocol of a multi- 
institutional study, or more broadly, by 
implementation of an institution-wide 
policy directive providing the allocation 
of responsibilities between the 


institution and all IRBs that are not 
operated by the institution. 
Documenting the responsibilities of the 
institution and the IRB is already a 
requirement under the terms of an FWA, 
but is now a regulatory requirement. An 
additional requirement has been added 
at§ —_—.115(a)(9) that such 
documentation be part of the IRB 
records. 

We acknowledge that the new 
requirement could increase 
administrative burden for some 
institutions, but believe that the 
examples cited above reflecting the 
various options an institution may use 
to document reliance on an IRB not 
operated by that institution are 
generally already standard practice in 
the regulated community. 

Finally, the final rule eliminates the 
requirement in the pre-2018 rule at 
§ _.103(f) that grant applications 
undergo IRB review and approval for 
the purposes of certification. The grant 
application is often outdated by the time 
the research study is submitted for IRB 
review and contains detailed 
information about the costs of a study, 
personnel, and administrative issues 
that go beyond the mission of the IRB 
to protect human subjects. Therefore, 
experience suggests that review and 
approval of the grant application is not 
a productive use of IRB time. 


V. Exempt Research (§ .104) 


A. Applicability of Exemptions to 
Subparts B, C, and D 


1. Background and Pre-2018 
Requirements 


In the pre-2018 rule, the application 
of the exemptions to research under 
subparts B, C, and D was specified 
through footnote 1, which stated that 
the exemptions do not apply to research 
involving prisoners, and are also limited 
in their application to research 
involving children. Regarding the latter 
issue, the pre-2018 exemption at 
§ .101(b)(2) for research involving 
educational tests, survey or interview 
procedures or observations of public 
behavior did not apply to subpart D (i.e., 
such research did not qualify for this 
exemption), except for research 
involving educational tests, or 
observations of public behavior when 
the investigator does not participate in 
the activities being observed. The pre- 
2018 exemptions did apply to subpart B. 


2. NPRM Proposals 


Although some of the exemptions 
proposed in the NPRM were based 
largely on exemptions in the pre-2018 
rule, not all would have applied to 
subparts B, C, and D. Language in the 
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NPRM explained how the proposed 
exemptions may have applied to the 
subparts. The NPRM proposed that all 
of the exemptions be applied to research 
conducted under subpart B, and that 
none of the exemptions may be applied 
to research conducted under subpart C, 
except for research aimed at a broader 
population that consists mostly of 
nonprisoners but that incidentally 
includes some number of prisoners. The 
NPRM proposed that some of the 
exemptions may be applied to research 
conducted under subpart D. Under the 
NPRM, the exemption at proposed 

§ _.104(e)(1) (Research Involving 
Educational Tests, Surveys, Interviews, 
or Observation of Public Behavior if the 
Information is Recorded with Identifiers 
and even if the Information is Sensitive) 
could not be applied to research 
involving children under subpart D. 
This was because protections including 
IRB review and parental permission are 
appropriate for research involving 
educational tests, surveys or interview 
procedures, or observation of public 
behavior when the information 
collected may be individually identified 
and sensitive in nature. 

Although the NPRM did not propose 
changes to the HHS regulations at 45 
CFR part 46, subparts B, C and D, 
consideration was given to whether the 
proposed exemption categories should 
apply to research involving prisoners 
under subpart C, either if the research 
consists mostly of nonprisoners and 
only incidentally includes some number 
of prisoners, or if the research intends 
to involve prisoners as research 
subjects. Public comment was requested 
on whether the revised exemption 
categories should be permitted to apply 
to research involving prisoners. The 
NPRM explained considerations 
including the following: The history of 
HHS subpart C research certifications to 
date; the preponderance of low-risk, 
sociobehavioral research focused on 
prisoner welfare, substance abuse 
treatment, community reintegration, and 
services utilization; the occurrence of 
prisoner-subjects in databases or 
registries; and the broad interpretation 
of the subpart C “prisoner” definition 
that includes, for example, subjects in 
court-mandated residential substance 
abuse treatment. 

The NPRM posed a question asking 
whether language in the final rule 
should resemble the 2003 waiver of the 
applicability of certain provisions of the 
rule for HHS-conducted or -supported 
epidemiologic research involving 
prisoners and state that the exemptions 
apply except for research where 
prisoners are a particular focus of the 


research.32 The language of the 2003 
waiver criteria are broader than what 
was proposed in the NPRM, and already 
familiar to the research community. 
They apply to epidemiological research 
that presents no more than minimal risk 
and no more than inconvenience to the 
prisoner/subjects. A question was also 
asked whether the proposed application 
of the exemptions to subparts B and D 
was appropriate. 


3. Public Comments 


Approximately 50 comments were 
received on the applicability of the 
proposed exclusions and exemptions to 
the subparts of the rule. Eight comments 
addressed the applicability of the 
exemptions to subparts B and D. 
However, responses to the question, ‘‘Is 
the proposed application of the 
exemptions to subparts B and D 
appropriate?” uniformly agreed with the 
proposal. A strong majority of the 
comments addressed the applicability of 
the exemptions to subpart C. 

The NPRM sought comment on the 
proposal to allow the exemptions to 
apply in research that only incidentally 
involves prisoners, but that is enrolling 
a primarily nonprisoner population. 
This would represent a policy shift in 
how the exemptions historically have 
been applied to subpart C. Comments 
regarding this proposal were mixed. 
Some responses claimed that the 
proposal expanded the application of 
the exemptions to all research under 
subpart C, rather than a small subset of 
subpart C research. Other comments 
opposed the proposal, pointing to the 
troubled history of research with 
prisoners, and suggesting that research 
involving prisoners, regardless of the 
risk level, should always go through 
subpart C IRB review. A narrow 
majority of comments responded that 
the exemptions should be permitted to 
apply to subpart C in a limited way. 
However, responses regarding the 
proposed language or which exemptions 
should be applicable to subpart C 
prisoners varied. Some felt a study 
should be exempted only if it offered 
some benefit to the prison population. 
Others felt it could be exempt so long 
as there was no identifiable sensitive 
information or biospecimens involved. 
Some who supported the proposal 
indicated that because the NPRM did 


32 HHS. Waiver of the Applicability of Certain 
Provisions of Department of Health and Human 
Services Regulations for Protection of Human 
Research Subjects for Department of Health and 
Human Services Conducted or Supported 
Epidemiologic Research Involving Prisoners as 
Subjects. FR 68(119):36929 (June 20, 2003). 
Retrieved from hitps://www.gpo.gov/fdsys/pkg/FR- 
2003-06-20/pdf/03-15580.pdf. 


not propose to expand the applicability 
of the exemptions to research targeting 
prisoners, the proposal seemed to be a 
reasonable expansion. One comment 
noted that permitting a broader 
interpretation might enable more 
prisoner-subjects to participate in 
potentially low-risk beneficial research. 
A few commenters addressed whether 
the language describing the applicability 
of the subparts to research involving 
subpart C should resemble the 2003 
epidemiological waiver criteria. Of 
these, comments were mixed, with some 
indicating that the 2003 epidemiological 
waiver criteria would be too ambiguous, 
others indicating that it would be 
appropriate language to use, and a final 
minority reiterating their opinion that 
the exemptions should never be 
permitted in research conducted under 
subpart C. 


4. Response to Comments and 
Explanation of the Final Rule: 
Applicability of Exemptions to Subparts 


The NPRM proposal regarding how 
the proposed exemptions may be 
applied to the subparts is largely 
unchanged in the final rule. The 
language at§ _—«.104(b)(2) regarding 
subpart C has been modified slightly to 
reduce ambiguity and potential 
administrative burden, and in response 
to public comment, to narrow the scope 
of exemption application. The final rule 
does not adopt the 2003 epidemiological 
waiver language due to concerns from 
public comments that such language 
would be ambiguous and difficult to 
interpret. 

The final rule section _.104(b)(1) 
states that all of the exemptions at 
§ .104 may be applied to research 
conducted under subpart B if the 
conditions of the exemption are met. 
Language at§ —_—«.104(b)(2) states that 
none ofthe § _.104 exemptions may 
be applied to research conducted under 
subpart C, except for research aimed at 
involving a broader subject population 
that only incidentally includes 
prisoners. This is a modification of the 
NPRM language, which proposed that 
the exemptions could apply if research 
consisted ‘“‘mostly of nonprisoners and 
only incidentally” included some 
number of prisoners. The language was 
changed in order to avoid the implied 
need (“‘mostly’’) for institutions to 
project and track the percentage of 
prisoners participating in nonexempt 
research. The revision also more clearly 
describes and limits the circumstances 
in which exempt research may include 
prisoners. The language at 
§ _.104(b)(3) relevant to subpart D 
has been modified to reflect the revised 
structure of the final rule, and now 
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states that the exemptions at paragraphs 
(d)(1), and (d)(4)-(8) of this section may 
be applied to research that is subject to 
subpart D if the conditions of the 
exemption are met. Paragraphs (d)(2)(i) 
and (ii) of this section may apply only 
to research activities that are subject to 
subpart D involving educational tests or 
the observation of public behavior when 
the investigator(s) do not participate in 
the activities being observed. Paragraph 
(d)(2)(iii) of this section may not be 
applied to research that is subject to 
subpart D, because protections, 
including IRB review and parental 
permission, are appropriate for research 
involving children and educational 
tests, surveys or interview procedures, 
or observation of public behavior when 
the information collected may be 
individually identified and sensitive in 
nature. 

The final rule does not make revisions 
to the HHS regulations at 45 CFR part 
46, subparts B, C, and D. Throughout 
this rulemaking process, the intent has 
been to revise subpart A, and to address 
revisions to subparts B, C, and D ata 
later time. However, particular 
consideration has been given to the 
specific issue of whether the proposed 
exemption categories should apply in 
the context of research that is aimed at 
a broad population and only 
incidentally includes prisoners. We 
concur with the comments expressing 
support for this change. 

In such instances, the specific 
protections required by subpart C are 
frequently not relevant to the research 
subjects. The permitted inclusion of this 
subset of prisoners under the 
exemptions at§ _.104 is intended to 
allow an appropriate reduction in IRB 
administrative burden while preventing 
IRBs from necessarily prohibiting the 
participation of this group in exempt 
research activities, assuming the 
conditions of the exemptions are fully 
satisfied. 

We believe this subpart C change is 
narrow in scope, affecting only a small 
subset of subjects who are prisoners. 
This change will permit, for example, 
the exempt secondary research use of 
information or biospecimens from 
subjects who are prisoners, if that 
analysis is not seeking to examine 
prisoners as a population and only 
incidentally includes prisoners in the 
broader study. Such inclusion would 
previously have required IRB review 
under subpart C, including review by an 
IRB prisoner representative, followed by 
certification to and authorization by 
OHRP. In addition, if the research did 
not fit into a § 46.306(a)(2) subpart C 
category of permissible research, 
prisoners could not be included as 


subjects in the study, thereby causing 
problems involving identifying and 
removing these subjects from the 
analysis of repositories and databases. 

Similarly, the narrow expansion 
would allow a subject to continue 
participation in exempt research if he or 
she became a prisoner during the course 
of an exempt study, assuming the study 
was aimed at a broad nonprisoner 
population, without the need for 
subpart C IRB review and certification 
to OHRP. For example, an exempt study 
that recruited subjects from a local 
community center to participate in a 
comparison of HIV educational 
materials would continue to be exempt, 
and would not trigger the need for 
review under subpart C, even if some of 
the subjects became prisoners after 
enrollment. On the other hand, a study 
that recruited subjects from a jail or 
prison to participate in a comparison of 
HIV educational materials would 
continue to be nonexempt under the 
final rule and require both subpart A 
and subpart C review, including 
certification to OHRP. 


B. Exemption Determination 


1. Background and Pre-2018 
Requirements 


The pre-2018 rule did not specify who 
at an institution may determine that 
research is exempt. However, in the 
past, OHRP has recommended that 
because of the potential for conflict of 
interest, investigators not be given the 
authority to make an independent 
determination that their human subjects 
research is exempt. OHRP has 
recommended that institutions 
implement exemption policies that most 
effectively address the local setting and 
programs of research. OHRP has 
recognized that this may result in a 
variety of configurations of exemption 
authority, any of which were acceptable 
assuming compliance with the pre-2018 
regulations. In addition, OHRP guidance 
provided that institutional policies and 
procedures should identify clearly who 
is responsible for making exemption 
decisions. We note that under the pre- 
2018 and final rule a Common Rule 
department or agency retains final 
authority as to whether a particular 
human subjects research study 
conducted or supported by that 
department or agency is exempt from 
the Common Rule. 


2. NPRM Proposals 


The NPRM proposed to adopt a 
requirement that exemption 
determinations be documented, and that 
such determinations could be made 
only in two specified ways. To assist 


investigators and institutions in making 
a timely and accurate determination of 
exemption status the NPRM proposed 
that federal departments or agencies 
would develop one or more exemption 
determination tools (the use of which 
would constitute one of the ways in 
which determinations could be made). 
Federal departments or agencies would 
create their own tool, or rely on a tool 
created by another department or 
agency (including a web-based tool 
created by HHS). Institutions would 
have discretion as to whether or not to 
implement such a tool. As proposed in 
the NPRM, it would be designed in such 
a way that if the person using the tool 
inputs accurate information about the 
study, the tool would produce a 
determination of whether the study is 
exempt. Institutions could rely on the 
use of the federally developed tool by 
investigators as a ‘“‘safe harbor’ for this 
determination. Use of the tool would be 
voluntary, and each institution and 
agency would decide whether to rely on 
the decision tool for their 
determinations, and if so, who would be 
allowed to use it. Institutions that chose 
not to use the tool for particular 
determinations would be required to 
have such determinations made by an 
individual who is knowledgeable about 
the exemption categories and who has 
access to sufficient information to make 
an informed and reasonable 
determination. In general, as envisioned 
in the NPRM, it was expected that 
investigators would not be allowed to 
make exemption determinations for 
themselves without the use of the 
decision tool, due to considerations of a 
conflict of interest. 

The NPRM requested public comment 
on several aspects of the proposal to 
develop a decision tool: (1) The 
likelihood of an institution allowing 
investigators to use the tool; (2) the ease 
of investigators contriving answers in 
using the tool; (3) whether use of the 
tool should be restricted to certain 
exempt categories of research; (4) 
whether deployment of such a tool 
would erode public trust in research; 
and (5) what additional information 
should be required to be kept as a record 
other than the information submitted 
into the decision tool. 

The NPRM also proposed that the 
institution or IRB be required to 
maintain records of exemption 
determinations, which records must 
include, at a minimum, the name of the 
research study, the name of the 
investigator, and the exemption category 
applied to the research study. As 
described in the NPRM, maintenance of 
the output of the completed decision 
tool would fulfill this recordkeeping 
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requirement. Although the NPRM did 
not propose an auditing requirement for 
assessing the accuracy of exemption 
determinations, it sought public 
comment about the need for one. 


3. Public Comments 


This was one of the more commented- 
on provisions of the NPRM, receiving 
approximately 280 comments. Public 
comment was generally mixed, with 
approximately half supporting and half 
opposing this proposal. A large majority 
noted that they felt unable to adequately 
respond to this proposal without seeing 
the decision tool first. Many of those 
who indicated general support for this 
proposal noted substantial 
qualifications to their support, such as 
the need to see the tool before deciding. 
Some requested that this proposal not 
be included in a final rule, and that a 
separate NPRM be issued specific to this 
proposal. Many commenters said that 
for simplicity and consistency, one tool 
should be agreed on by all of the 
sponsoring departments and agencies 
and that the departments and agencies 
should involve research administration 
professionals in developing such a tool 
so that it would have field-friendly 
workability and produces trustworthy 
results. Further, they thought that the 
tool should be pilot tested and validated 
by institutions and investigators before 
being deployed. For those who 
supported the concept of a decision 
tool, they felt that its use would speed 
the review process for exempt research. 
Some cited long wait times to receive an 
exemption determination from their 
institution’s IRB. 

Some commenters stated that the tool 
should clearly indicate that although it 
determines exemption from federal 
regulations, state restrictions still apply. 
A large academic center argued that 
though the tool could be useful, for 
institutions that provide services, 
treatment, and care for vulnerable 
populations it might be prudent to have 
someone with expertise in human 
research protections independently 
review research proposals to determine 
whether they are exempt or excluded 
from IRB review, rather than rely on the 
tool. 

One large research university 
questioned the need for such a tool, 
asserting that properly designed 
oversight and review of exempt research 
should take minimal time and ensure 
that only exempt research is conducted 
without IRB approval. This commenter 
preferred comprehensive guidance on 
exempt research to support IRBs in 
making efficient and expeditious 
exemption determinations. A large 
academic/research organization 


concurred, pointing out confusion 
among investigators about exempt 
categories, which requires careful 
conversation with IRB officers to 
understand how their project fits into 
the human protection framework. This 
organization believed that these 
conversations promote safe and effective 
research decision making and argued 
that use of the tool could fail to properly 
educate investigators about the 
complexities of exempt research 
determinations. 

Some commenters noted that the 
decisions produced by the tool would 
be only as good as the tool and the 
materials and guidance that accompany 
it. Some commenters added that it is 
unlikely, however, that the use of a 
federal decision tool would shield the 
institution or investigator from liability 
in third-party actions. Still others went 
so far as to say that they doubted their 
institution would allow its use, at least 
for some time after which it was proven. 
To the extent institutions are not 
engaged in the exemption determination 
process through the tool, some argued 
that institutions should not be held 
accountable for any unintended 
outcomes. 

Of those who commented on whether 
investigators should be allowed and 
trusted to use the exemption 
determination tool, some noted that it 
seemed inappropriate and a conflict of 
interest for investigators to be allowed 
to use the tool to generate exemption 
determinations for their own research 
activities. Others noted that an 
investigator might be able to use the 
tool, but that the proposed exemptions 
categories were so nuanced that 
experienced IRB staff might have 
difficulty determining what qualifies for 
an exemption. To that end, these 
comments noted that the tool would 
need to be accompanied with 
substantial guidance for an investigator 
to be able to accurately input 
information into it. Finally, some 
commenters expressed concern about 
the possibility that investigators might 
enter inaccurate or misleading 
information into the tool to “game the 
system,” while others noted that that 
possibility, although remote, exists in 
the current protocol submission process 
and that a well-developed tool could 
include a means for validating certain 
types of inputs to assess accuracy. 


4. Response to Comments and 
Explanation of the Final Rule: 
Exemption Determination 


The final rule does not adopt the 
NPRM proposal at this time. Therefore, 
the final rule does not require that 
exemption determinations be 


documented, as had been proposed in 
the NPRM, and continues to permit 
flexibility in how exemption 
determinations are made. We recognize 
it was difficult to provide detailed 
feedback in the absence of an exemption 
decision tool to evaluate. However, we 
continue to believe that a well-designed, 
tested, and validated exemption 
decision tool could offer an expedient 
mechanism for determining whether 
research studies are exempt. Thus, we 
will continue to explore development of 
an exemption decision tool. If and when 
an exemption decision tool is 
developed, we would issue a 
subsequent (separate) Federal Register 
notice for public comment. The notice 
would also give the public the 
opportunity to comment on whether the 
use of the tool would be appropriate in 
making exemption determinations 
under this final rule. Thus, members of 
the public would be afforded a 
sufficient opportunity to provide 
meaningful comments on such a 
proposed decision tool. 


C. Categories of Exempt Research 


The following sections describe the 
categories of exempt research found in 
the final rule. Note that several 
categories of activities proposed in the 
NPRM as exclusions appear in the final 
rule as exemptions. 


1. Background and Pre-2018 Rule 


Under the pre-2018 rule, a research 
activity qualified for exemption from 
the Common Rule if it fell into one or 
more of six categories at 
§ _.101(b)(1)-(6). Such studies were 
fully exempt from the regulations. That 
is, so long as a study did indeed fall 
within a category, it did not need to 
satisfy any other regulatory 
requirements that it needed to satisfy 
under the pre-2018 rule. 


2. NPRM Proposals 


The NPRM proposed that all 
exemption language would be found at 
§ .104. The NPRM proposed 
retaining all of the exemption categories 
in the pre-2018 rule in one form or 
another except for the exemption 
pertaining to research involving the use 
of educational tests, survey or interview 
procedures or observation of public 
behavior if the subjects are elected or 
appointed officials, or if the 
confidentiality of the information were 
protected by statute. However, the 
NPRM proposed re-classifying some of 
the pre-2018 rule’s exemptions as 
exclusions under the NPRM (and thus 
they would not have been subject to 
administrative or IRB review), while 
retaining some of the pre-2018 rule’s 
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exemptions as exemptions (versus 
exclusions). 

The NPRM proposed eight 
exemptions divided into three 
categories: (1) Low-risk interventions for 
which there would have been no other 
requirement (e.g., informed consent and 
privacy safeguards) other than the 
determination and recording 
requirements; (2) research activities that 
would have required application of 
privacy safeguards; and (3) secondary 
research involving biospecimens and 
identifiable private information that 
would have required application of 
privacy safeguards, broad consent, and 
limited IRB review. The NPRM 
proposed to have some exempt studies 
meet certain other regulatory 
requirements while not having to meet 
other requirements, making them not 
“fully exempt” in the sense of the pre- 
2018 rule. 

The NPRM proposed retaining 
exemption categories § _.101(b)(1), 
(5), and (6) from the pre-2018 rule. The 
NPRM proposed clarifying the 
exemption for research on public benefit 
programs or demonstration projects in 
the pre-2018 rule and explained that 
OHRP’s guidance would be changed to 
include the applicability of the 
exemption to cover research on public 
benefit and service programs that an 
agency does not itself administer 
through its own employees or agents. 
The NPRM proposed requiring federal 
departments or agencies conducting 
such studies to publish a list of studies 
under this exemption. 

The NPRM proposed that new 
exemptions would be created for: 

e Certain research involving benign 
interventions; 

e Certain research involving 
educational tests, survey or interview 
procedures, or observation of public 
behavior where identifiable private 
information was recorded, so long as 
data protection standards are met; 

e Secondary research use of 
identifiable private information 
originally collected for nonresearch 
purposes; 

e Activities relating to storing and 
maintaining biospecimens and 
identifiable private information for 
secondary research use, if subjects 
provided broad consent; 

e Secondary research studies that 
would use the biospecimens and 
identifiable private information stored 
or maintained under the above 
exemption. 

The NPRM asked for public comment 
on several aspects of these proposals, as 
they appeared as either exemptions or 
exclusions and whether their placement 
in the NPRM was appropriate with 


regard to protecting human subjects in 
research. Comment was requested on 
whether guidance would be needed to 
help make exemption determinations 
and whether the scopes of the proposed 
exemptions or proposed exclusions 
were appropriate. That is, whether 
particular exclusions or exemptions 
were either too narrow or too broad. For 
example, several questions were posed 
about whether research should be 
exempt if it involved psychological 
risks. The NPRM asked about whether 
notice should be given to subjects for 
any of the activities. The public was 
asked to comment on whether and how 
exempt activities could comply with the 
NPRM ’s proposed privacy safeguards. 

The NPRM also inquired whether the 
exemption category related to research 
conducted in established or commonly 
accepted educational settings should 
apply only to research activities in 
which notice is given to prospective 
subjects or their legally authorized 
representatives as a regulatory 
requirement, when not already required 
under the Privacy Act of 1974. If so, 
comment was sought on the type of 
information to include in the notice and 
on how such notice should be delivered. 

The NPRM asked for feedback on 
whether the proposed privacy 
safeguards should apply to research 
included in the proposed exempt 
category related to research conducted 
in established or commonly accepted 
educational setting, given that such 
research may involve risk of disclosing 
identifiable private information. The 
public was also asked to comment on 
whether the protections provided by the 
HIPAA Rules for identifiable health 
information used for health care 
operations, public health activities, and 
research activities are sufficient to 
protect human subjects involved in such 
activities, and whether the current 
process of seeking IRB approval 
meaningfully adds to the protection of 
subjects involved in such research 
studies. 

The NPRM asked about the extent to 
which the HIPAA Rules and the Health 
Information Technology for Economic 
and Clinical Health (HITECH) Act 33 
adequately address the beneficence, 
autonomy, and justice considerations 
related to collecting new information 
and whether any exemption for such 
collection should be limited to data 
collected or generated in the course of 
clinical practice. 

With regard to the proposed 
exemption related to research and 


33 The legislative language can be found at 
https://www.healthit.gov/sites/default/files/hitech_ 
act_excerpt_from_arra_with_index.pdf. 


demonstration projects conducted or 
supported by a federal department or 
agency, the public was asked to 
comment on: (1) Whether notice should 
be given to prospective subjects and the 
nature of such notice; (2) whether such 
activities can involve greater than 
minimal risk and whether they are 
appropriate as exemptions; and (3) 
whether existing privacy safeguards for 
such activities were sufficient. 

A proposed new exemption category 
was intended to facilitate secondary 
research using identifiable private 
information that would have been or 
would be collected or generated for 
nonresearch purposes, when prior 
notice had been given and privacy 
safeguards and prohibitions on re-use of 
the information were in place. The 
public was asked to comment on what 
types of research should fall under this 
proposed exemption, whether it should 
be limited to research in which 
individuals have been informed of the 
potential for future research use of their 
information and given the opportunity 
to opt out, and whether the exemption 
would be appropriate for clinical data 
registries. 

Finally, public comment was sought 
on two related proposed exemptions for 
research involving the use of 
biospecimens or identifiable private 
information that would have been 
stored or maintained for secondary 
research use, if consent for the storage 
and maintenance of the information and 
biospecimens had been obtained using a 
broad consent template that the NPRM 
proposed would be developed by the 
Secretary of HHS. 


3. Public Comments, Response to 
Comments, and Explanation of the Final 
Rule: Exemption Categories 


All exemption categories, of which 
there are eight, appear at § ——.104 in 
the final rule. Four of the exemption 
categories were proposed as exclusions 
under the NPRM. In addition, the 
proposed exclusion concerning certain 
research involving educational tests, 
survey or interview procedures, or 
observation of public behavior has been 
combined with the exemption regarding 
additional research activities using the 
same research methods. The rule 
includes four exemptions for research 
involving normal educational practices, 
research involving benign behavioral 
interventions, research involving public 
benefit or service programs, and 
research involving taste and food 
quality, all of which were also proposed 
in the NPRM. 

Three exemptions pertain to 
secondary research uses of identifiable 
private information or identifiable 
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biospecimens. One exemption, at 

§ _.104(d)(4), which concerns 
secondary research for which consent is 
not required, which consists of three of 
the proposals for exclusions in the 
NPRM. A second exemption, at 

§ _.104(d)(7), pertains to storage or 
maintenance of identifiable private 
information or identifiable 
biospecimens for which broad consent 
is required, and a third exemption, at 

§ _.104(d)(8), concerns secondary use 
of identifiable private information or 
identifiable biospecimens for which 
broad consent is required. As will be 
discussed in more detail below, some of 
the conditions associated with the 
finalized exemptions differ from what 
was proposed in the NPRM. 

In the final rule, similar to what was 
proposed in the NPRM, “exempt” does 
not always mean exempt from all of the 
requirements of the Common Rule; the 
activity must fit the description of the 
exempt category and not include 
nonexempt research activities. For 
example, the exemption categories in 
the final rule at § —_—.104(d)(7) and (8) 
identify specific regulatory 
requirements that must be met (e.g., 
limited IRB review, the use of broad 
consent) as a condition of being exempt 
from other regulatory requirements. 

Public comments, responses to 
comments, and explanations of the final 
rule for each exemption category follow. 


a. Research Conducted in Established or 
Commonly Accepted Educational 
Settings When It Specifically Involves 
Normal Educational Practices 
(§___.104(d)(1)) 


i. Public Comments 


Approximately 50 comments 
discussed this exemption, which was a 
slight modification of an exemption that 
existed in the pre-2018 rule. The NPRM 
asked two questions about this 
exemption: (1) whether it should require 
some type of notice and if so, how 
notice should be delivered; and (2) 
whether the proposed privacy 
safeguards should apply to this 
exemption. 

One commenter (a research dean from 
a university) suggested that the wording 
of the exemption be modified from 
“research conducted in established or 
commonly accepted educational 
settings” to “research conducted in 
established or commonly accepted 
educational or other settings” in order 
to allow more flexibility in how this 
exemption could be applied. 

Other commenters noted a need for 
guidance on how this exemption should 
be interpreted. For example, one 
comment suggested that a wide array of 


“normal” educational practices exists, 
and the intention of this language was 
difficult to discern. Another comment 
noted that clarification was needed 
about permissible data collection 
methods under this exemption. 

One commenter discussing the 
addition of the limitation that the study 
should not be likely to adversely affect 
students’ opportunity to learn noted that 
it might be difficult to predict ahead of 
time if the research contemplated under 
this exemption might have this adverse 
impact. 

Several commenters discussed 
whether notice should be required. The 
majority of these comments indicated 
that some type of notice should be 
required. A few specifically discussed 
the importance of notifying subjects of 
these activities (with one commenter 
stating that parental consent should be 
required), stating that lack of notice 
could erode public trust in research. 

Groups representing AI/AN tribal 
interests argued that notice for this type 
of research should be required. 
Specifically, they asserted that 
transparency around research-related 
activities and policies, especially in 
school settings, can build trust among 
AI/AN populations and ensure that 
individual and community benefits of 
participation in research are achieved. 
They also noted that tribal consultation 
facilitates decisions about appropriate 
ways to implement such notices, and 
observed that the rural nature of many 
AI/AN communities requires the use of 
multiple modes of communication and 
more time spent reaching the intended 
audience. The commenter also noted 
that potential subjects should be given 
the opportunity to opt out of research 
activities. 

One commenter argued that notice is 
generally an insufficient standard for 
this type of research and is not a 
suitable substitute for informed consent. 

Approximately 20 comments 
discussed whether the proposed privacy 
safeguards that appeared at§ ——.105 in 
the NPRM should apply to this 
exclusion. Comments were generally 
mixed about whether this would be 
appropriate, with a small majority 
indicating that the privacy safeguards 
should not apply. These comments 
generally argued that if an activity is 
exempt, no additional requirements 
should be placed on that research 
activity. 

A privacy advocacy organization that 
supported both notice and attaching the 
proposed privacy safeguards to this 
provision, stated that notice in this 
context is also important because other 
federal standards (e.g., Family 
Educational Rights and Privacy Act 


[FERPA; 20 U.S.C. 1232g; 34 CFR part 
99], Protection of Pupil Rights 
Amendment [PPRA; 20 U.S.C. 1232h; 34 
CFR part 98]) are not acceptable proxies 
for privacy protection. This commenter 
indicated that the notice should be 
robust with detailed information 
presented to parents directly. As 
justification for providing additional 
protections in this context, this group 
noted that the consequences for misuse 
of data are greater for children; that is, 
lost, misused, or leaked information 
about children could have lifelong 
consequences. The commenter argued 
that if an exemption is proposed for this 
class of research, then the lack of IRB 
oversight should require that 
researchers must comply with 
appropriate privacy safeguards. 


ii. Response to Comments and 
Explanation of the Final Rule: 
Exemption for Certain Research 
Conducted in Certain Educational 
Settings 


The final rule includes an exemption 
at§ _.104(d)(1) for research 
conducted in established or commonly 
accepted educational settings that 
specifically involves normal educational 
practices, so long as the research is not 
likely to adversely affect students’ 
opportunity to learn required 
educational content or the assessment of 
educators who provide instruction. This 
includes most research on regular and 
special education instructional 
strategies, and research on the 
effectiveness of, or the comparison 
among, instructional techniques, 
curricula, or classroom management 
methods. 

This exemption is a revised version of 
the first exemption in the pre-2018 rule 
and a modified version of the exemption 
as proposed in the NPRM. This change 
is based on concerns about whether the 
conduct of some research projects of 
this type might draw enough time and 
attention away from the delivery of the 
regular educational curriculum that they 
could have a detrimental effect on 
student achievement. The wording of 
the exemption has been modified to 
include a condition that the research is 
not likely to have these adverse impacts. 
This was the original intent of the 
NPRM proposal, and it is an important 
qualification that should apply to any 
research activity that is exempt under 
this provision. It also drops the phrase 
“in that educational setting,’ because 
that phrase is redundant. 

The exemption is retained to allow for 
the conduct of education research that 
may contribute to the important public 
good of improving education, consistent 
with the principle of beneficence. The 
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exemption retains the condition that the 
research activity takes place in 
established or commonly accepted 
educational settings, because otherwise 
IRB review would be warranted for such 
research activities being conducted in 
unconventional settings. 

We recognize that providing notice for 
this type of research could involve a 
significant administrative burden and 
that it is not always appropriate, and 
therefore have decided not to include it 
as a regulatory requirement at this time. 
We note that making these activities 
exempt does not mean that there ought 
not to be tribal consultation about the 
research activities, and that such 
consultation may lead to a notice 
requirement. Where appropriate or 
mandated by tribal law, tribal 
consultation should take place 
irrespective of whether the activity has 
to meet the requirements of this final 
rule. Such consultation would represent 
a free-standing legal obligation, as is 
referred to in § .101(f).When 
appropriate, investigators may provide 
notice in a manner that is appropriate to 
the research activity and the cultural 
context in which it occurs. 

This exemption is largely unchanged 
from the pre-2018 rule, and does not 
add requirements for safeguarding 
privacy at this time. 


b. Research That Includes Only 
Interactions Involving Educational Tests 
(Cognitive, Diagnostic, Aptitude, 
Achievement), Survey Procedures, 
Interview Procedures, or Observation of 
Public Behavior (Including Visual or 
Auditory Recording), If at Least One of 
Three Criteria Is Met (§____—.104(d)(2)) 


This exemption in the final rule is a 
revised version of an exemption in the 
pre-2018 rule, and is a combination of 
a provision proposed as an exclusion in 
the NPRM, and a provision proposed as 
an exemption in the NPRM. Thus, 
public comments on both of these 
proposals follow here. 





i. Public Comments 


Approximately 80 comments 
discussed this proposed exclusion, 
which was an exemption in the pre- 
2018 rule. Public comments were 
mixed. Some felt that moving these 
activities from the exemption to 
exclusion category would streamline 
this type of low-risk, common research 
activity and allow IRBs to focus time 
and attention on more complicated and 
higher risk activities. Others, including 
SACHRP and many research 
universities, argued that based on their 
experience, investigators have difficulty 
making the assessments required to 
determine whether an activity falls 


under this exemption. For example, 
investigators have a difficult time 
determining whether disclosure outside 
of the research context might put 
someone at risk of criminal or civil 
liability. 

Commenters also expressed concern 
about whether the three statutes cited in 
the third prong of the proposed 
exclusion would provide a comparable 
level of protections to human subjects as 
does the Common Rule. Many of these 
commenters noted that they simply 
were not sure what types of protections 
would be afforded to subjects under the 
Privacy Act, the Paperwork Reduction 
Act, and the E-Government Act of 2002. 
Others noted that the main protections 
provided by these statutes involved 
notice and not ethics review. 

The NPRM requested comment on the 
extent to which covering educational 
tests, survey procedures, interview 
procedures, or observation of public 
behavior under the Common Rule 
would substantially add to the 
protections provided to human subjects. 
Public comment was mixed, but the 
majority of commenters felt that these 
activities should be exempt rather than 
excluded. One commenter indicated 
that contrary to the primary justification 
for excluding these categories of 
research, these activities cannot always 
be considered to be low risk and could 
pose significant risks depending on the 
nature of the research and sensitivity of 
the data collected. 

One commenter expressed strong 
opposition to excluding these activities 
from Common Rule protections, 
indicating that excluding them would 
compromise the rights and welfare of 
research subjects. The commenter 
emphasized that consent cannot be 
inherent to participation in the activity 
because researchers cannot know with 
certainty that participants are familiar 
with common forms of educational 
tests, surveys, and interview procedures 
and the potential risks inherent to 
information disclosure. In addition, the 
commenter pointed out, assuming that 
even vulnerable subjects know the risks 
associated with participation in surveys 
and interviews is contrary to the 
Belmont Report’s assertion that 
vulnerable subjects need additional 
protection. 

Some comments were mixed, for 
example, suggesting that observation of 
public behavior might be an acceptable 
exclusion, whereas surveys and 
interviews ought to remain exempt. One 
commenter indicated that it might be 
reasonable for these activities to be 
excluded if an exclusion determination 
tool was available to help investigators 
make the decision. Another commenter 


suggested that whether the activities are 
exempt or excluded, notice should be 
required, to indicate the purpose of the 
activity, describe privacy safeguards, 
state that participation is voluntary, and 
provide information on opting out. 

Other commenters expressed concern 
that investigators might not be able to 
effectively make these determinations, 
and pointed out that IRBs, with a broad 
range of experience and expertise in 
data identifiability, provide a check for 
researchers’ judgment and are better 
placed to make consistent and informed 
decisions about exemptions. 

Even so, some other commenters felt 
that Common Rule protections do not 
substantially add to the protection of 
human subjects in these categories of 
activities. Thus, categorizing them as an 
exemption just adds administrative 
burden. 

The NPRM asked whether this 
exclusion should apply only to research 
activities in which notice is given to 
prospective subjects or their legally 
authorized representatives as a 
regulatory requirement, and if so, what 
information should be included in the 
notice. Some commenters supported a 
requirement for notice or at a minimum, 
some sort of tracking system for these 
activities. One emphasized that the 
ethical principle of respect for persons 
demands some sort of notice. Some 
indicated that requiring notice prevents 
these activities from being excluded and 
might necessitate including them on the 
list of activities for expedited review 
rather than deeming them exempt 
activities. 

Other commenters expressed concern 
about the proposed exclusion. For 
example, one indicated that it might not 
be correct to assume that people agree 
to participate, and understand that they 
can opt out, by virtue of their 
participation, and another reiterated 
concern about assuming that these 
activities are inherently low risk and 
expressed a desire to keep these 
activities in the exempt category to 
maintain a level of IRB oversight. 

The NPRM asked whether it is 
reasonable to rely on investigators to 
make self-determinations for the types 
of research activities covered in this 
particular exclusion category, and if so, 
whether documentation of any kind 
should be generated and retained. One 
commenter expressed a strong opinion 
that investigators should be allowed 
make these self-determinations. 
However, the majority of comments 
responding to this question felt that 
investigators should not be solely 
responsible for making these 
determinations. 
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Some commenters felt that self- 
determination might work in certain 
cases or with certain groups but that 
there would be too much variability to 
allow it generally. One suggested a 
screening system that might check 
whether determinations were being 
made correctly. 

Many commenters pointed out that it 
is unreasonable to expect investigators 
to be able to reliably discern levels of 
risk inherent to disclosure of 
information, and that what might seem 
innocuous to researchers could cause 
real harm to others. Other commenters 
expressed concern about conflicts of 
interest, and that investigators might be 
more likely to make a determination to 
not delay their research. Another 
commenter emphasized that oversight is 
necessary to avoid situations in which 
investigators inaccurately assume that 
subjects understand that they are 
participating in research, or that they 
are being recorded, for example. 

The NPRM requested comment on 
whether some or all of these activities 
should be exemptions rather than 
exclusions. Response to this question 
was mixed. Some commenters felt that 
these activities should be excluded. 
Others felt that surveys and interview 
should be considered exempt while 
educational tests and observation of 
public behavior should be excluded. 
Still others felt that all should be 
exemptions except for observations of 
public behavior, which could be 
excluded. 

The NPRM asked whether these 
exclusions should be narrowed such 
that studies with the potential for 
psychological risk are not included and 
whether certain topics that involve 
sensitive information should not be 
covered by this exclusion. There was 
general agreement among responses to 
this question that the exclusions should 
be narrowed so that studies with the 
potential for psychological risk were not 
included in the exclusion. Some 
commenters, however, indicated that it 
would be unrealistic to expect 
investigators to make this determination 
reliably, that it might be challenging to 
implement such a policy, and that 
guidance would be required from 
regulatory bodies. 

Commenters felt that these activities 
should be exemptions rather than 
exclusions, to preserve a level of IRB 
oversight. One commenter pointed out 
that circumstances that occur in 
research for which psychological risks 
are possible are fairly common in this 
category of activities and that excluding 
them would leave the risk unaddressed. 
One professional organization 
emphasized that the ‘potential for 


serious psychological harms that may be 
associated with participation in 
nonbiological research. . . [is] not 
merely the result of inappropriate 
disclosure of information.” It also 
indicated that ‘‘the probability and 
magnitude of this risk may vary by 
characteristics of individual 
participants, clinical expertise of the 
interviewer(s), as well as the risk- 
minimizing protections that are in 
place.” 


The NPRM requested comment on 
whether for activities captured under 
the third element of this exclusion, the 
statutory, regulatory, and other policy 
requirements cited provide enough 
oversight and protection that being 
subject to expedited review under the 
Common Rule would produce minimal 
additional subject protections. If so, the 
NPRM asked whether the exclusion 
should be broadened to also cover 
secondary analysis of information 
collected pursuant to such activities. Of 
the few responses to this question, one 
commenter felt that existing protections 
are sufficient if information is stored in 
a secure information technology (IT) 
infrastructure. 


Other organizations expressed strong 
sentiments that neither the Paperwork 
Reduction Act nor the Privacy Act were 
protective in the research context and 
that current privacy protections are 
inadequate. They stressed the 
importance of safeguarding IT and cyber 
infrastructure and provided examples of 
large data breaches. 


The NPRM asked about the extent to 
which excluding any of these research 
activities from the Common Rule could 
result in an actual or perceived 
reduction or alteration of existing rights 
or protections provided to human 
subjects. That is, does excluding these 
research activities from the Common 
Rule pose any risks to scientific 
integrity or public trust? Commenters 
who responded to this question 
generally felt that excluding any of these 
research activities could result in an 
actual or perceived reduction or 
alteration of existing rights or 
protections provided to human subjects. 
One indicated that reduction in 
oversight would lead to subjects being 
exposed to unintended risks that 
otherwise would be preventable. Other 
commenters felt that improper 
assumptions about low levels of risk in 
these activities and allowing for self- 
determination could lead to a reduction 
in protections for human subjects. 


ii. Public Comments on the Proposed 
Exemption for Research Involving 
Educational Tests, Surveys, Interviews, 
or Observation of Public Behavior If the 
Information Is Recorded With 
Identifiers, and Even If the Information 
Is Sensitive 


Approximately 50 comments 
discussed the proposal to exempt 
educational tests, surveys, interviews, or 
observation of public behavior if the 
information is recorded with identifiers 
and even if the information is sensitive. 
Public comment here was mixed, with 
some agreeing that by mandating 
privacy safeguards, the proposal 
effectively addresses the primary risk 
that occurs in this type of research. 
Others argued that this type of research 
still benefits from some type of IRB 
review and thus should be considered 
covered rather than exempted research. 
Yet other comments noted that it was 
impossible to make a determination 
about this proposed exemption without 
seeing the proposed privacy safeguards 
that were proposed in the NPRM. 

Several commenters noted that the 
parameters of this exclusion might be 
acceptable if it excluded sensitive topics 
or if it excluded research studies that 
posed psychological harm to potential 
subjects. One comment by a 
professional organization of psychology 
professionals noted that IRBs often 
misunderstand and overstate 
psychological risks in research. Because 
of this, this group argued that the rule 
should not include a limitation based on 
psychological risks because IRBs are not 
able to effectively assess psychological 
risks. 

The NPRM also asked whether this 
exemption should be extended to 
research involving children. The 
majority of those who responded to this 
question were opposed to such an 
extension. 


iii. Response to Comments and 
Explanation of the Final Rule: 
Exemption for Certain Research 
Involving Educational Tests, Surveys, 
Interviews, or Observation of Public 
Behavior Under Specific Conditions 


The final rule includes an exemption 
at§ _.104(d)(2) that is a revised 
version of an exemption in the pre-2018 
rule. The exemption applies to research 
that only includes interactions 
involving educational tests (cognitive, 
diagnostic, aptitude, achievement), 
survey procedures, interview 
procedures, or observation of public 
behavior (including visual or auditory 
recording) uninfluenced by the 
investigator if at least one of three 
criteria is met: 
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e The information obtained is 
recorded by the investigator in such a 
manner that the identity of the human 
subject cannot readily be ascertained, 
directly or through identifiers linked to 
the subjects; 

e Any disclosure of the human 
subjects’ responses outside the research 
would not reasonably place the subjects 
at risk of criminal or civil liability or be 
damaging to the subjects’ financial 
standing, employability, educational 
advancement, or reputation; or 

e The information obtained is 
recorded by the investigator in such a 
manner that the identity of human 
subjects can readily be ascertained, 
directly or through identifiers linked to 
the subjects, and an IRB conducts a 
limited IRB review to make the 
determination required b 
§ _.111(a)(7) (which relate to there 
being adequate provisions for protecting 
privacy and maintaining 
confidentiality). 

The final rule does not include the 
language proposed in the NPRM that 
offered as one prong of the exemption 
(proposed as an exclusion) that the 
research be subject to the Privacy Act, 
the Paperwork Reduction Act, or the E- 
Government Act of 2002. The final rule 
simply includes § .104(d)(2)(iii), 
which requires limited IRB review as 
described at§ _—_—.111(a)(7) if 
identifiable private information will be 
obtained and recorded in such a way 
that the identity of human subjects can 
readily be ascertained, either directly or 
through identifiers linked to the subject. 

This exemption is based on the 
assumption that the potential risks 
raised by this category are largely 
informational and that subjects are 
aware of them, and thus the most 
important role that an IRB might play 
with respect to reducing potential harms 
is to ensure the application of privacy 
safeguards. Under this assumption, the 
exemption is consistent with the 
principle of respect for persons and the 
preservation of autonomy. In the case of 
observation of public behavior, even if 
the subject does not know that an 
investigator is watching his or her 
actions, the subject’s behavior is public 
and could be observed by others, and 
thus the research observation is not 
inappropriately intrusive. 

The term “‘survey” as used here refers 
to information collected about 
individuals through questionnaires or 
similar procedures (e.g., the Current 
Population Survey conducted by the 
U.S. Census). “Human subjects” do not 
include organizations or businesses. 
“Survey,” as used here, does not 
include the collection of biospecimens. 
Thus, an activity that included the 





collection of a biospecimen (e.g., a 
cheek swab), in addition to collecting 
verbal or written responses to questions, 
could not qualify for this exemption. 

This exemption includes the research 
activities that appeared at 
§ _.101(b)(2) in the pre-2018 rule, as 
well as some additional information 
collection research activities using the 
same methods. As in the pre-2018 rule, 
this exemption includes research 
studies whose methods consist of the 
use of educational tests, survey or 
interview procedures, or observation of 
public behavior that does not involve an 
intervention, if the data are recorded 
anonymously, or the information is 
recorded with identifiers, but is not 
sensitive such that its disclosure could 
result in harm to the subjects. The 
exemption provides a list of the specific 
harms that must be considered, as did 
the pre-2018 rule, with the addition of 
the specific harm of potential damage to 
the subjects’ educational advancement. 
This potential harm has been added 
because of the obvious relevance to the 
effects of the disclosure of responses in 
research involving educational tests. 

This exemption has been expanded to 
include research using the same 
methods involving identifiable private 
information that might be sensitive or 
potentially harmful if disclosed, so long 
as the investigators adhere to the limited 
IRB requirements outlined in 
§ _.111(a)(7), and the research is not 
subject to Subpart D. The limited IRB 
review requirements are designed to 
provide privacy safeguards to reduce the 
chances that the disclosure of 
identifiable private information will 
occur and lead to harm. 

The wording of the exemption is 
clarified to indicate (consistent with the 
interpretation of § _.101(b)(2) in the 
pre-2018 rule) that the research cannot 
include interventions in addition to the 
educational tests, survey or interview 
procedures, or observation of public 
behavior. Research involving 
interventions that are distinct from 
those information collection methods 
allowable under this exemption do not 
satisfy the conditions of this exemption. 
For example, if a research study were to 
randomly assign students to take an 
educational test in a quiet room or ina 
room with a moderate level of noise, or 
to consume a snack (or not) before 
taking the test, this research would not 
be exempt under this exemption. It 
should be noted, however, that 
educational tests may include exposing 
test takers to certain materials as part of 
the test, and that such materials do not 
constitute interventions distinct from 
the test. For example, reading 
comprehension tests may direct test 


takers to read a passage, and a 
geography test may present test takers 
with a map, and ask them to draw 
information from that map. Likewise, 
survey procedures may contain some 
information that the respondents are 
asked questions about, which would not 
be considered distinct interventions. 
However, research in which the purpose 
of the research is to see whether 
respondents answer survey questions 
differently depending on the gender of 
the interviewer would not satisfy the 
conditions of the exemption, because 
the manipulation of the interviewer 
would be a distinct intervention. 
Research involving observation of 
public behavior does not qualify for this 
exemption if the investigator intervenes 
with subjects, for example, by offering 
them an ostensibly lost wallet to see if 
they will accept it. 

Part of the rationale for exempting the 
research activities at§ —_.104(d)(2) 
from the Common Rule, even when the 
research is not otherwise subject to 
additional federal controls, is that for 
education tests, survey or interview 
procedures, agreement to participate is 
inherent in participation and that for 
much of this research the risks most 
likely to be experienced by subjects are 
related to disclosure of anonymous, 
nonsensitive information and are thus 
categorized as “low.” In general, it is 
reasonable to expect that individuals, 
including vulnerable populations (other 
than children), would understand that 
actively providing responses to 
educational tests, surveys, or interview 
procedures constitutes agreement to 
participate and that the risks associated 
with such participation would be 
related to disclosure of the information 
they provided. The exemption of this 
type of activity rests in large part on the 
idea that all individuals, regardless of 
the setting or context in which the 
activity will take place, are generally 
familiar with common forms of 
educational tests and survey and 
interview procedures that they 
experience in their daily lives, and do 
not need additional measures to protect 
themselves and their privacy from 
investigators who seek their 
involvement in research activities 
involving these procedures. They can 
decline to participate, or to answer some 
questions. In addition, if the 
information collected is both 
identifiable and sensitive or potentially 
harmful, the safeguards offered by the 
limited IRB review requirements at 
§ _.111(a)(7) apply. This is 
accomplished through the added 
provision at § —_.104(d)(2)(iii). 

Concerns have also been raised about 
psychological risks of participating in 
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surveys or interviews, and of situational 
risks where the simple awareness that 
someone was surveyed or interviewed 
poses a risk. We recognize that this is 
possible, but believe that this is rare 
enough that it does not warrant adding 
additional conditions to the exemption 
category. 

With respect to applying this 
exemption to research with children, 
two subcategories of this exemption— 
concerning information recorded so that 
subjects cannot be identified 
(§_—«.104(d)(2)(i)), and concerning 
disclosures of the subjects’ responses 
that would not place them at certain 
kinds of risk or create certain kinds of 
damage (§___—.104(d)(2)(ii))—-may 
apply to research involving children 
under subpart D if the research involves 
educational tests or observation of 
public behavior and the investigator 
does not participate in the activities 
being observed. The final subcategory of 
this exemption (§__.104(d)(2)(iii)), 
which allows for obtaining and 
recording identifiable private 
information, may not be applied to 
research involving children under 
subpart D. 


c. Research Involving Benign Behavioral 
Interventions in Conjunction With the 
Collection of Information From an Adult 
Subject (§____.104(d)(3)) 


i. Public Comments 


Approximately 50 comments 
discussed the NPRM proposed 
exemption involving benign 
interventions in conjunction with 
collecting information from an adult 
subject. Public comments here were 
mixed, with a majority favoring this 
exemption, and with the majority of 
commenters indicating that guidance 
will be needed for this exemption to be 
implemented properly. For example, 
one large research university stated, 
“The proposed category involving 
benign interventions needs further 
revision. While we are supportive of 
this category in general, the words 
‘benign intervention’ without definition 
leaves too much room for different 
interpretations and these terms are not 
easily applicable to social science 
research, a context in which these types 
of activities are likely to occur.’ Those 
that favored this exemption generally 
agreed with the argument put forth in 
the NPRM that these activities were low 
in risk and IRB review did not provide 
subjects meaningful additional 
protections in this context. 

Several comments requested 
clarification on the extent to which 
medical interventions might be covered 
under this exemption. For example, to 


what extent could proven diagnostic 
methods that introduce energy but are 
not invasive (e.g., magnetic resonance 
imaging, ultrasound, computerized 
tomography scan) be considered a 
“benign intervention” for the purpose of 
this exemption? Another comment 
asked whether the provision included 
the use of medical devices, such as 
blood pressure monitors or 
thermometers. 

Those who did not support this 
exemption offered a variety of reasons. 
One comment from a research 
university indicated that it did not 
support this exemption because it could 
cause studies like the “Milgram 
Obedience Experiment” 34 and the 
“Stanford Prison Study’”’ 35 to occur 
without IRB review. Another comment 
reiterated the general stance that all 
research activities should require IRB 
review and informed consent. 

One comment from a research ethics, 
public education, and professional 
organization noted that if the final rule 
includes an expansion of exemption 
categories such as the proposed benign 
intervention exemption in the NPRM, 
then investigator education on human 
subjects protection should be mandated. 

Another comment noted that it should 
be clarified in the regulatory text that 
withholding the investigator’s 
hypothesis from subjects is not 
deception. 

The majority of commenters indicated 
that no additional requirements, be it 
notice or the proposed privacy 
safeguards, should be applied to this 
exemption category. A minority of 
comments indicated that some kind of 
notice should be required with this 
provision, generally asking for that 
notice to include the purpose of the 
study, the privacy and confidentiality 
protections in place, a statement that 
participation is voluntary, information 
on how to opt out of the study, and 
information about who to contact for 
more information. Comments that 
favored notice suggested that the notice 
should be study-specific. 

Although commenters generally felt 
the examples of activities that would 
satisfy this exemption included in the 
regulatory text were sufficient, 
commenters also indicated that many of 
the terms used in this exemption 


34 Milgram S. Behavioral Study of Obedience. The 
Journal of Abnormal and Social Psychology, 1963; 
67(4):371-378. Retrieved from hitp:// 
www.columbia.edu/cu/psychology/terrace/w1001/ 
readings/milgram.pdf. 

35 Haney C, Banks WC, and Zimbardo PG. A study 
of prisoners and guards in a simulated prison. 
Naval Research Review, 1973, 30:4—17. Retrieved 
from http://www.simplypsychology.org/zimbardo- 
paper.pdf. 


needed additional explanation, for 
example, “‘brief in duration,” 
“painless,” and ‘“‘physically invasive.” 
A large research university noted that 
the proposed language raised questions 
about what sorts of impact are 
significant and how long is “‘lasting.”’ 

One large professional organization 
representing research universities and 
organizations noted that the term 
“benign intervention” did not seem to 
encapsulate the types of activities that 
the NPRM contemplated. Specifically, 
this organization argued that ‘‘benign 
intervention” connotes a medical 
procedure, when the NPRM preamble 
suggested that this exemption 
encompasses nonmedical ‘‘benign 
interventions” generally. This 
organization also suggested that the 
activities contemplated by this 
exemption are more like interactions 
than interventions. 

In response to a question about 
whether the decision tool could be 
relied on for making this exemption 
determination, a majority of those who 
responded indicated that it would be 
impossible to answer this question 
without first seeing the decision tool. 
Others indicated that without better 
definition of terms like “benign 
intervention,” ‘prospectively agree,”’ 
“long lasting,’ and “significant impact,” 
it would be impossible for a tool to 
provide accurate determinations for this 
exemption. 


ii. Response to Comments and 
Explanation of the Final Rule: 
Exemption for Certain Research 
Involving Benign Behavioral 
Interventions in Adults 


This exemption at§ —_—.104(d)(3) 
was not in the pre-2018 rule, but was 
proposed in the NPRM. In response to 
public comments that expressed 
concern over the need to further clarify 
the term ‘‘benign interventions,” the 
word “‘behavioral”’ has been inserted to 
modify the type of intervention which 
may be included. The intent of this 
change is to exclude the use of medical 
interventions (including medical tests, 
procedures and devices). The exemption 
being finalized is specifically for 
research involving benign “behavioral” 
interventions in conjunction with the 
collection of information from an adult 
subject through verbal or written 
responses (including data entry) or 
audiovisual recording if the subject 
prospectively agrees to the intervention 
and information collection and at least 
one of the following is met: 

e The information obtained is 
recorded by the investigator in such a 
manner that the identity of the human 
subjects cannot readily be ascertained 
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directly or through identifiers linked to 
the subjects; 

e Any disclosure of the human 
subjects’ responses outside the research 
would not reasonably place the subjects 
at risk of criminal or civil liability or be 
damaging to the subjects’ financial 
standing, employability, educational 
advancement, or reputation; or 

e The information obtained is 
recorded by the investigator in such a 
manner that the identity of the human 
subjects can readily be ascertained, 
directly or through identifiers linked to 
the subject, and an IRB conducts a 
limited IRB review to make the 
determination required by 
§ _.111(a)(7). 

For the purpose of this provision, the 
exemption describes benign behavioral 
interventions as being brief in duration, 
harmless, painless, not physically 
invasive, not likely to have a significant 
adverse lasting impact on the subjects, 
and the investigator has no reason to 
think the subjects will find the 
interventions offensive or embarrassing. 
Provided all such criteria are met, 
examples of such benign behavioral 
interventions include having the 
subjects play an online game, solve 
puzzles under various noise conditions, 
or decide how to allocate a nominal 
amount of received cash between 
themselves and someone else. 

Unlike the exemption at 
§ _.104(d)(2), this exemption allows 
for the intervention to be distinct from 
the data collection method; for example, 
a research study comparing test 
performance of test takers in quiet or 
noisy surroundings would qualify for 
this exemption. Also subjects could be 
asked to perform cognitive tasks, and 
audiovisual recording could be used to 
collect the data, without any 
educational test, survey or interview 
procedure occurring, and this research 
would qualify for this exemption. 

If the research involves deceiving the 
subjects about the nature or purposes of 
the research, this exemption would not 
be applicable unless the subject 
authorizes the deception. For the 
purpose of this provision, authorized 
deception would be prospective 
agreement by the subject to participate 
in research where the subject is 
informed that he or she will be unaware 
of or misled regarding the nature or 
purposes of the research. The final rule 
allows this type of research to occur 
without the requirements of informed 
consent because the intervention is not 
likely to result in harm or offense to the 
subject, and the subject must 
prospectively agree to the intervention 
and the data collection. 


Subjects must be adults, but the 
provision does not specify that they 
must be competent, and therefore tests 
of competency are not necessary. 
However, the presumption is that, in 
keeping with the principle of respect for 
persons, such subjects will not be 
exploited. 

This new exemption category is 
added because respect for persons is 
accomplished through the prospective 
subject’s forthcoming agreement or 
authorization to participate, the research 
activities pose little risk to subjects, and 
the use of this exemption for many 
social or behavioral studies will enable 
IRBs to devote more time and attention 
to research studies involving greater 
risks or ethical challenges. We note that 
the requirement for the agreement of the 
subject effectively serves as a kind of 
notice, because the subject is asked to 
agree to participate in the research, and 
the request will be tailored to the nature 
of the specific research study. 

The final rule includes another 
condition that was not included in the 
NPRM, which broadens the type of 
research that may meet this exemption. 
The final rule at § ——_—.104(d)(3)(i)(C) 
permits investigators to obtain and 
record information in such a manner 
that the identity of the human subjects 
can readily be ascertained, directly or 
through identifiers linked to the subject, 
provided the research has undergone 
limited IRB review in accord with 
§ _.111(a)(7). This alternative 
condition was added to the final rule for 
reasons similar to the exemption at 
§ _.104(d)(2), as a way of providing 
additional protections when 
investigators obtain and record 
information in such a manner that 
human subjects can be identified 
directly or through identifiers linked to 
the subject. Because the risk associated 
with enabling investigators to obtain 
and record identifiable private 
information can be addressed by 
requiring adherence to the privacy 
safeguards provided through limited 
IRB review, we believe it is appropriate 
to allow such research to be exempt. 

In addition, the final rule permits the 
collection of data through audiovisual 
recording, not just video recording, as 
was proposed in the NPRM. We believe 
that broadening the exemption in this 
way provides more flexibility to the 
permissible data collection methods 
without creating greater risk of harm to 
research subjects. 

We acknowledge that guidance may 
be useful for interpreting some of the 
terms in this exemption, and that some 
cases will be debatable. However, we 
also believe that a substantial number of 
research activities will plainly fit this 


exemption, and should be allowed to 
proceed without IRB review. We agree 
that investigator education is often 
desirable, but that the provisions of the 
exemption are not difficult to 
understand. We believe that Milgram’s 
obedience experiments and the Stanford 
Prison Experiment would obviously not 
qualify for this exemption, because 
investigators had reason to think some 
subjects would find the interventions 
offensive or embarrassing. We 
acknowledge that in this exemption the 
word ‘‘deception”’ is used to include 
withholding the purpose of the research, 
which is consistent with how the term 
is often used in this context. 


d. Secondary Research Use of 
Identifiable Private Information and 
Identifiable Biospecimens for Which 
Consent Is Not Required 
(§___.104(d)(4)) 


i. Overview 


The final rule exemption at 
§ _.104(d)(4) is for secondary 
research use of identifiable private 
information and identifiable 
biospecimens for which consent is not 
required. This particular exemption 
combines several NPRM exclusion 
proposals. It exempts secondary 
research use of identifiable private 
information and identifiable 
biospecimens when: 

e The identifiable private information 
or identifiable biospecimens are 
publicly available; 

e The information is recorded by the 
investigator in such a way that the 
identity of subjects cannot readily be 
ascertained, and the investigator does 
not contact subjects or try to re-identify 
subjects; 

e The secondary research activity is 
regulated under HIPAA; or 

e The secondary research activity is 
conducted by or on behalf of a federal 
entity and involves the use of federally 
generated nonresearch information 
provided that the original collection was 
subject to specific federal privacy 
protections and continues to be 
protected. 


By ‘‘secondary research,’ this 
exemption is referring to re-using 
identifiable information and identifiable 
biospecimens that are collected for some 
other “primary” or “‘initial” activity. 
The information or biospecimens that 
are covered by this exemption would 
generally be found by the investigator in 
some type of records (in the case of 
information) or some type of tissue 
repository (such as a hospital’s 
department for storing clinical 
pathology specimens). 
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It is important to recognize that this 
exemption does not cover any primary 
collections of either information or 
biospecimens. For example, if an 
investigator wants to collect information 
directly from research subjects by asking 
them to complete a questionnaire, that 
would not be covered by this 
exemption. If an investigator wants to 
collect biospecimens by having subjects 
swab their cheek, that would similarly 
not be covered by this exemption. On 
the other hand, an investigator who 
wants to use information that is in some 
databank, or use biospecimens that are 
in a pathology laboratory, or use the 
“excess” portion of blood that was 
drawn for clinical purposes, could use 
this exemption assuming all of the 
relevant conditions are met. 

Also, note that unlike the pre-2018 
rule’s exemption relating to certain 
secondary uses of information and 
biospecimens, the final rule has no 
requirement that the information and 
biospecimens must be pre-existing at 
the time that the investigator begins a 
particular research study. For example, 
an investigator could start a study that 
involves using biospecimens from 
clinical pathology laboratories, and 
could include specimens that are added 
to the laboratories during the course of 
the study (again assuming that the other 
conditions of the exemption are met). 

Public comments on each of the 
exclusions proposed in the NPRM and 
combined in this exemption follow. 


(1) Public Comments on the Proposed 
Exclusion for Research Involving the 
Collection or Study of Identifiable 
Private Information or Identifiable 
Biospecimens That Are Publicly 
Available or Recorded by the 
Investigator Without Identifiers 


Approximately 50 commenters 
discussed this proposed exclusion about 
identifiable private information or 
identifiable biospecimens that are 
publicly available or recorded by the 
investigator without identifiers. Public 
comments were mixed, with many 
indicating that investigators should not 
themselves be allowed to determine 
whether their research fits under this 
exclusion, and many indicating that this 
should be an exemption rather than an 
exclusion. A majority supported the 
clarifying language that this category of 
activities could include information that 
will be collected. 

One commenter indicated that the 
prohibition on re-identification should 
apply to activities in publicly available 
data sets. This commenter also 
indicated that any research involving re- 
identification should undergo IRB 
oversight. Another commenter 


suggested that there should also be a 
prohibition in this category against the 
release or publication of information 
that would lead to re-identification. 

One commenter indicated that the 
terminology used in this provision 
needed clarification. Specifically, the 
commenter wondered how one should 
interpret the term “recorded by the 
investigator’ with respect to electronic 
data? 

In response to a question posed in the 
NPRM about whether any of the 
exclusion categories should include 
biospecimens, a majority of those who 
responded to the question indicated that 
biospecimens should be included in this 
category. 

The NPRM also asked whether this 
exclusion should apply to activities 
involving prisoners. Of those who 
responded to this question, responses 
were mixed with some indicating that 
this exclusion should apply to research 
with prisoners and others indicating 
that it would be inappropriate for 
research with prisoners to be allowed. 
One commenter indicated that allowing 
prisoners in this type of research would 
be a weakening of protections in 
activities involving vulnerable 
populations. 


(2) Public Comments on the Proposed 
Exclusion for Certain Activities Covered 
by HIPAA 


Approximately 50 comments 
discussed the NPRM proposal to 
exclude certain activities subject to 
HIPAA. Public comments were mixed, 
with many indicating that the 
protections required under HIPAA for 
“health care operations,” ‘‘research,”’ 
and “public health activities,” were 
sufficient, and that for the types of 
activities identified by the exclusion, 
review under the Common Rule did not 
provide meaningful protections. In 
contrast, others argued that because the 
scope of a privacy review board is 
narrower than for an IRB, these 
activities should not receive a blanket 
exclusion from the Common Rule. 

Under the HIPAA Privacy Rule, 
health information is de-identified and 
thus exempt from that rule only if it 
neither identifies nor provides a 
reasonable basis to believe that the 
information can be used to identify an 
individual. The HIPAA Privacy Rule 
provides two ways to de-identify 
information: (1) A formal determination 
by a qualified expert that the risk is very 
small that an individual could be 
identified; or (2) the removal of all 18 
specified identifiers of the individual 
and of the individual’s relatives, 
household members, and employers, as 
long as the covered entity has no actual 


knowledge that the remaining 
information could be used to identify 
the individual (45 CFR 164.514(b)). 

Otherwise, the HIPAA Privacy Rule 
addresses some informational risks by 
imposing restrictions on how 
individually identifiable health 
information collected by health plans, 
health care clearinghouses, and most 
health care providers (‘covered 
entities”) may be used and disclosed, 
including for research. In addition, the 
HIPAA Security Rule (45 CFR parts 160 
and subparts A and C of part 164) 
requires that these entities implement 
certain administrative, physical, and 
technical safeguards to protect this 
information, when in electronic form, 
from unauthorized use or disclosure. 
However, the HIPAA Rules apply only 
to covered entities (and in certain 
situations to their business associates). 
Not all investigators are part of a 
covered entity and thus some 
investigators are not required to comply 
with those rules. Moreover, the HIPAA 
Rules do not apply specifically to 
biospecimens in and of themselves. 

One commenter proposed that the 
exclusion be expanded so that 
investigators from noncovered entities 
(as defined in the HIPAA Rules) would 
be eligible for the exclusion as well. 
Another commenter suggested that the 
HIPAA exclusion should be expanded 
to cover business associates and 
researchers that comply with HIPAA. 

The NPRM asked whether the 
protections provided by the HIPAA 
Rules for identifiable health information 
used for health care operations, public 
health activities, and research activities 
are sufficient to protect human subjects 
involved in such activities, and whether 
the current process of seeking IRB 
approval meaningfully adds to the 
protection of human subjects involved 
in such research studies. Approximately 
half of the comments that addressed this 
question suggested that HIPAA 
protections are sufficient and that no 
additional safeguards were needed. 
Others expressed concern, and 
suggested that in some, if not all, of the 
categories in the HIPAA exclusion, 
HIPAA protections would not be 
sufficient. 

One commenter suggested that this 
exclusion might be appropriate for 
health care operations or public health 
activities, but that the HIPAA rules were 
not sufficiently protective for research 
activities. Specifically, one commenter 
expressed concern that excluding from 
the Common Rule the use of PHI for 
research activities in HIPAA-covered 
entities would weaken protections for 
patients, because HIPAA’s privacy 
safeguards were never intended to 
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replace human subject protections and 
associated ethical and scientific review. 


One commenter also noted that other 
HHS preambles to rules have discussed 
the differences between the Common 
Rule and HIPAA, and these preambles 
noted that HIPAA was not intended to 
replace the Common Rule. This 
commenter suggested that given the 
language included in previous HHS 
preambles, additional justification for 
this exclusion would be needed before 
being included in a final rule. 


One commenter felt that the HIPAA 
rules and HITECH adequately address 
the Belmont Report principles with 
respect to these exclusions from the 
Common Rule, but felt the exclusion 
should not be limited to covered 
entities. The commenter suggested that 
the exclusion be extended to 
noncovered entities that receive PHI and 
are required to apply HIPAA safeguards 
in addition to institutions with 
equivalent protections. Others suggested 
that the HIPAA and HITECH standards 
are too protective for much research. 


Other commenters felt that this set of 
exclusions violates the protective 
mandate because HIPAA’s provisions 
are narrow and do not reflect research 
ethics concerns. They noted that 
HITECH addresses technical data 
security for covered PHI for health care 
use but not for research use, especially 
if the data are sent elsewhere. 
Commenters felt that data used for 
research should be subject to HITECH 
data security standards and should not 
be excluded from Common Rule 
coverage. 


Few commented on whether 
additional collections (i.e., collections 
beyond what would ordinarily be 
collected through routine medical care) 
should be covered by this exclusion, 
and those that did suggested that they 
should be subject to the Common Rule 
unless those additional collections are 
covered by another exemption and 
exclusion. 


The NPRM asked whether additional 
or fewer activities regulated under the 
HIPAA Privacy Rule should be included 
in this exclusion. One commenter 
expressed concern that the HIPAA 
Privacy Rule was not appropriate 
because it both underregulates and 
overregulates research. Another 
commenter felt that the exclusion 
creates confusion because HHS has, in 
other contexts, discussed the differences 
between the Common Rule and HIPAA 
and the differing needs in separate 
contexts. 


(3) Public Comments on Research 
Conducted by a Government Agency 
Using Government-Generated or 
Government-Collected Data Obtained 
for Nonresearch Activities 


Approximately 20 comments 
discussed this proposed exclusion. 
Public comment was mixed, with 
several commenters suggesting that they 
did not understand the full scope of the 
information generated or collected by 
the government that would fall under 
this exclusion. A minority of comments 
indicated that this category of activities 
should be exempt rather than excluded. 


The NPRM also asked whether this or 
a separate exclusion should also include 
research involving information collected 
for nonresearch purposes by nonfederal 
entities where comparable privacy 
safeguards have been established by 
state law or regulation. Few responded 
to this question. Of these, several 
indicated that this exclusion should not 
be expanded to cover nonresearch data, 
and should not be expanded to cover 
activities conducted by 
nongovernmental investigators using 
government-generated or -collected 
data. Several comments indicated that 
this category was acceptable as an 
exclusion, with a few commenters 
suggesting that the category could be 
further broadened. 


One commenter suggested that this 
provision should apply to nonfederal 
entities if state laws are as protective as 
the federal laws cited. This commenter 
indicated that for these types of 
activities, the Common Rule protections 
did not provide meaningful additional 
protections to subjects. In contrast, 
several other commenters expressed 
concern that the privacy safeguards 
identified in this exclusion were not as 
protective of subjects as the Common 
Rule. One commenter indicated that 
clarifying what constitutes appropriate 
nonfederal use of this exclusion would 
be needed. 


One commenter suggested that this 
exclusion might be reasonable as an 
exclusion if there were a public posting 
requirement for activities conducted 
under this exclusion. If this were the 
case, this commenter indicated that 
investigator self-determination of 
whether an activity fit under this 
exclusion would be reasonable. 


In response generally to the question 
of whether any of the exclusions should 
apply to activities involving prisoners, a 
small number of comments addressed 
this question in the context of this 
exclusion. Of these responses, 
comments were mixed. 


ii. Response to Public Comments and 
Explanation of the Final Rule: 
Exemption for Secondary Research for 
Which Consent Is Not Required 


This exemption at § _.104(d)(4) is 
for secondary research uses of 
identifiable private information or 
identifiable biospecimens when consent 
is not required, if at least one of the 
following criteria is met: 

e The identifiable private information 
or identifiable biospecimens are 
publicly available; 

e Information, which may include 
information about the biospecimens, is 
recorded by the investigator in such a 
manner that the identity of human 
subjects cannot readily be ascertained 
directly or through identifiers linked to 
the subjects, the investigator does not 
contact the subjects, and the investigator 
will not re-identify subjects; 

e The research involves only 
information collection and analysis 
involving the investigator’s use of 
identifiable health information when 
that use is regulated under 45 CFR parts 
160 and 164, subparts A and E, for the 
purposes of “‘health care operations” or 
“research” as those terms are defined at 
45 CFR 164.501 or for ‘‘public health 
activities and purposes” as described 
under 45 CFR 164.512(b); or 

e The research is conducted by, or on 
behalf of, a federal department or 
agency using government-generated or 
government-collected information 
obtained for nonresearch activities, if 
the research generates identifiable 
private information that is or will be 
maintained on information technology 
that is subject to and in compliance 
with section 208(b) of the E-Government 
Act of 2002, 44 U.S.C. 3501 note, if all 
of the identifiable private information 
collected, used, or generated as part of 
the activity will be maintained in 
systems of records subject to the Privacy 
Act of 1974, 5 U.S.C. 552a, and, if 
applicable, the information used in the 
research was collected subject to the 
Paperwork Reduction Act of 1995, 44 
U.S.C. 3501 et seq. 


The criteria for this exemption were 
proposed in the NPRM as three 
exclusions. The final rule modifies the 
NPRM proposal to allow this exemption 
to apply to secondary research involving 
identifiable biospecimens, provided that 
the exemption’s conditions are met. 
Note that because the NPRM proposal to 
alter the definition of a human subject 
to extend to research involving 
nonidentified biospecimens was not 
adopted, an exemption for research with 
such biospecimens is not needed. 
Accordingly, this exemption is only 
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relevant to secondary research use of 
identifiable biospecimens. 

The goal of the exemption at 
§ _.104(d)(4) is to facilitate secondary 
research using identifiable private 
information or identifiable 
biospecimens that have been or will be 
collected or generated for nonresearch 
purposes or from research studies other 
than the proposed research study. 
Unlike two other new exemptions that 
also relate to secondary research (the 
onesat§ _.104(d)(7) and 
§ _.104(d)(8), discussed below), this 
exemption does not depend on any 
consent requirements imposed by the 
Common Rule being met. 

The first two provisions of this 
exemption (§___.104(d)(4)(i) and (ii)) 
are a modified version of the fourth 
exemption under the pre-2018 rule. The 
modified provisions allow the 
exemption to include research with 
information and biospecimens that do 
not yet exist when the research study is 
proposed for exemption (i.e., that could 
be collected, for purposes not related to 
the proposed research study, in the 
future). 

The third and fourth provisions of the 
exemption have no precursors in the 
pre-2018 rule. The third provision 
applies the exemption to secondary 
research using identifiable private 
information covered under HIPAA, and 
the fourth provision applies the 
exemption to secondary research using 
identifiable private information 
collected for nonresearch purposes by 
the Federal Government, if compliant 
with the three cited federal statutes. 
These new rules will allow investigators 
to see identifiable private information, 
and also allow them to retain and record 
that information (including the 
identifiers) as part of their research 
records. 

We also note that, according to new 
language at§ —_—«.104(b)(2) adopted as 
part of this final rule, this exemption 
permits the secondary research use of 
identifiable private information or 
identifiable biospecimens obtained from 
subjects who are prisoners, if the 
research is not designed in a way that 
seeks to recruit prisoners as a 
population but rather only incidentally 
(i.e., not intentionally) includes 
prisoners. 


(1) Response to Public Comments and 
Explanation of the Final Rule: Research 
Involving the Collection or Study of 
Identifiable Private Information or 
Identifiable Biospecimens That Are 
Publicly Available 


The exemption criterion at 
§ .104(d)(4)(i) is for secondary 
research if the identifiable private 


information or identifiable 
biospecimens are publicly available. 
This would apply to secondary research 
use of archives in a public library, for 
example, or to government or other 
institutional records where public 
access is provided on request, or from 

a commercial entity if the information is 
provided to members of the public on 
request or if the only requirement for 
obtaining the information is paying a 
user fee, registering or signing in as a 
visitor to an archive. It would also apply 
if a commercial entity made identifiable 
biospecimens publicly available to 
anyone on request or for a fee. This 
exemption effectively acknowledges 
that for secondary research with 
publicly available information or 
biospecimens, IRB review would not 
reduce the risk. 


(2) Response to Public Comments and 
Explanation of the Final Rule: Research 
Involving the Collection or Study of 
Information (Which May Include 
Information About Biospecimens) That 
Has Been or Will Be Collected and Is 
Recorded Without Identifiers 


The provision at § —_.104(d)(4)(ii) 
exempts research involving identifiable 
private information, which may include 
information about biospecimens, if 
information is recorded by the 
investigator in such a manner that the 
identity of human subjects cannot 
readily be ascertained directly or 
through identifiers linked to the 
subjects, the investigator does not 
contact the subjects, and the investigator 
will not re-identify subjects. As with the 
provision at§ _.104(d)(4)(i), this 
provision is related to an exemption that 
existed in the pre-2018 rule. In this 
instance, that prior exemption is being 
extended to now also cover research 
with information for which identifiers 
have been removed when the original 
collection of information or 
biospecimens occurs in the future. 


(3) Response to Public Comments and 
Explanation of the Final Rule: The 
HIPAA Exclusion 


The provision at§ __.104(d)(4) (iii) 
permits the secondary research use of 
identifiable private information or 
identifiable biospecimens when the 
research involves only information 
collection and analysis involving the 
investigator’s use of identifiable health 
information when that use is regulated 
under 45 CFR parts 160 and 164 (the 
HIPAA Privacy Rule), subparts A and E, 
for the purposes of “health care 
operations” or “‘research”’ as those terms 
are defined at 45 CFR 164.501, or for 
“public health activities’ as described 
under 45 CFR 164.512(b). 


With regard to the criterion at 
§ .104(d)(4)(iii), HIPAA also 
provides protections in the research 
context for the information that would 
be subject to this exemption (e.g., 
clinical records), such that additional 
Common Rule requirements for consent 
should be unnecessary in those 
contexts. Under HIPAA, these 
protections include, where appropriate, 
requirements to obtain the individual’s 
authorization for future, secondary 
research uses of protected health 
information, or waiver of that 
authorization by an IRB or HIPAA 
Privacy Board. This provision 
introduces a clearer distinction between 
when the Common Rule and the HIPAA 
Privacy Rule apply to research in order 
to avoid duplication of regulatory 
burden. We believe that the HIPAA 
protections are adequate for this type of 
research, and that it is unduly 
burdensome and confusing to require 
applying the protections of both HIPAA 
and an additional set of protections. 

This provision was not part of the pre- 
2018 rule, and was proposed as an 
exclusion in the NPRM. It is included as 
a component of an exemption in the 
final rule, consistent with public 
comments supporting the proposal. 





(4) Response to Public Comments and 
Explanation of the Final Rule: Research 
Conducted by a Government Agency 
Using Government Generated or 
Government Collected Data Obtained for 
Nonresearch Activities 


The provision at§ _.104(d)(4)(iv) 
did not exist in the pre-2018 rule and 
was proposed as an exclusion in the 
NPRM. It appears as a component of an 
exemption in the final rule. The 
exemption permits the use of 
identifiable private information or 
identifiable biospecimens for secondary 
research conducted by, or on behalf of, 
a federal department or agency using 
government-generated or government- 
collected information obtained for 
nonresearch activities, if the 
information originally involved a 
collection that adheres to the federal 
standards for safeguarding privacy as 
described in this part of the exemption. 

We believe that the privacy 
protections are adequate for this type of 
research, and that it is unduly 
burdensome and confusing to require 
these protections and an additional set 
of protections. This provision has been 
modified to apply the federal statutory 
privacy safeguards identified in the 
exemption provision to both the original 
collection of the information, and to the 
secondary research use of the 
information to which the exemption 
applies. 
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e. Research and Demonstration Projects 
Conducted or Supported by a Federal 
Department or Agency (§ .104(d)(5)) 


i. Public Comments 


Approximately 35 comments 
discussed the changes proposed in the 
public benefit or service program 
exemption. Few of the comments 
discussed the proposed expansion in 
OHRP’s interpretation of this exemption 
to include the applicability of the 
exemption to cover research on public 
benefit and service programs that an 
agency does not itself administer 
through its own employees or agents, 
with a majority supporting the NPRM 
proposed expansion. One research 
university indicated that OHRP should 
not expand its interpretation of this 
exemption, and that it should be limited 
to “federally funded studies evaluating 
federal programs.” This institution did 
not offer justification for its comment. 

Few comments were received about 
the proposed requirement for exemption 
designation of research or 
demonstration projects to be posted to a 
publicly available federal Web site. The 
comments discussing this proposed 
requirement supported it. 

The majority of comments indicated 
that no additional requirements or 
limitations should be imposed on this 
exemption. These institutions argued 
that because this exemption represented 
a mechanism through which the Federal 
Government evaluated its own 
programs, additional limitations and 
restrictions in the Common Rule did not 
seem appropriate. 

Specifically, with respect to whether 
or not some sort of notice should be 
required here, several commenters 
noted that any notice would need to be 
meaningful. One commenter indicated 
that because meaningful notice would 
be difficult, a notice requirement should 
not be imposed. One comment 
suggested that notice should only be 
required if opt-out would be permitted, 
and if not, no notice requirement should 
be imposed. Groups representing AI/AN 
populations supported the notice 
requirement and indicated that it should 
be required at a minimum. 


ii. Response to Comments and 
Explanation of the Final Rule: 
Exemption for Certain Research and 
Demonstration Projects Conducted or 
Supported by a Federal Department or 
Agency 

The final rule includes this exemption 
as a modified version of an exemption 
proposed in the NPRM. The exemption 
at§ _.104(d)(5) in the final rule 
applies to research and demonstration 
projects involving public benefit or 


service programs, and is a slightly 
revised version of the exemption in the 
pre-2018 rule. This revision is designed 
to clarify the scope of the exemption so 
that more research studies would be 
eligible, and to make the exemption 
easier to apply. It is also designed to 
allow the Federal Government to carry 
out important evaluations of its public 
benefit and service programs to ensure 
that those programs are cost effective 
and provide the intended benefits or 
services, consistent with the principle of 
beneficence. The wording of the 
exemption has added “improve” to the 
purposes of these activities, to make 
more explicit the idea that the Federal 
Government conducts these activities in 
order to enable them to make the public 
benefit and service programs better, and 
not just to gauge their current quality. 

This exemption is for research and 
demonstration projects that are 
conducted or supported by a federal 
department or agency, or otherwise 
subject to the approval of department or 
agency heads. It applies to activities that 
are designed to study, evaluate, 
improve, or otherwise examine public 
benefit or service programs, including, 
but not limited to: Procedures for 
obtaining benefits or services under 
those programs; possible changes in or 
alternatives to those programs or 
procedures; or possible changes in 
methods or levels of payment for 
benefits or services under those 
programs. 

In addition, the final rule clarifies the 
language of the exemption to conform to 
OHRP’s previous interpretation of 
public benefit and service programs that 
are being evaluated as part of the 
research. This interpretation includes 
public benefit or service programs that 
a Common Rule department or agency 
does not itself administer or conduct 
through its own employees or agents, 
but rather supports through a grant or 
contract program. Therefore, the 
exemption applies to research and 
demonstration projects supported 
through, for example, federal grants or 
cooperative agreements. These changes 
would bring the regulatory language 
into conformance with other provisions 
of the rule that refer to research 
“conducted or supported” by federal 
departments and agencies. These 
methods of administration are, of 
course, always subject to department or 
agency head approval, either directly or 
by delegation. In addition, some of these 
research and demonstration projects are 
conducted through waivers, interagency 
agreements, or other methods that also 
require agency head approval. 
Accordingly, both the previous and 
revised language allow for the full 


panoply of methods by which research 
and demonstration projects on public 
benefit or service programs can be 
carried out. 

The wording of the exemption also is 
clarified to specifically include projects 
involving waivers of otherwise 
mandatory requirements using 
authorities such as sections 1115 and 
1115A of the Social Security Act, in 
order to make it plain that such research 
projects on public benefit or service 
programs qualify for the exemption. The 
relevant sections of the Social Security 
Act were also cited when this 
exemption was published in 1983. 

In the interest of transparency, as was 
proposed in the NPRM, the final rule 
requires that each federal department or 
agency conducting or supporting the 
research and demonstration projects 
must establish, on a publicly accessible 
federal Web site or in such other 
manner as the department or agency 
head may determine, a list of the 
research and demonstration projects the 
federal department or agency conducts 
or supports under this provision. The 
research or demonstration project must 
be published on this list before 
beginning the research involving human 
subjects. The department or agency 
head can determine what sort of 
information will be included on this list 
and maintains its oversight. 
Departments and agencies that already 
publish research and demonstration 
projects on a publicly accessible Web 
site could satisfy this proposed 
requirement if the existing Web site 
includes a statement indicating which 
of the studies were determined to meet 
this exemption. 

The goal of this proposed requirement 
is to promote transparency of federally 
conducted or supported activities 
affecting the public that are not subject 
to oversight under the Common Rule. It 
should not cause any delay to the 
research. HHS will develop a resource 
that all Common Rule departments and 
agencies may use to satisfy the 
requirement at§ __—.104(d)(5)(i). 
Alternatively, an agency can create or 
modify its own Web site for this 
purpose. 

The exemption is not modified to 
require notice, to apply only to minimal 
risk research activities, or to require the 
privacy safeguards, for reasons reflected 
in the public comments. We agree with 
the public comments that argued that in 
many cases notice would be difficult or 
impossible to achieve effectively, and 
that this exemption enables the Federal 
Government to conduct important 
evaluations of its own programs that 
provide significant benefits to the 
public. In addition, federal departments 
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and agencies are already subject to other 
laws and policies that protect the 
interests of research subjects (e.g., the 
Privacy Act). 


f. Taste and Food Quality Evaluation 
and Consumer Acceptance Studies 


(§___.104(d)(6)) 


i. Public Comments 


Approximately 20 comments 
discussed this exemption for taste and 
food quality evaluation and consumer 
acceptance studies. The NPRM did not 
propose changes to this exemption from 
what appeared in the pre-2018 rule. 
However, it did ask whether this 
exemption should be narrowed to apply 
only to activities for which prospective 
subjects have been given prior notice, 
and if so, how that notice should be 
issued. The NPRM further asked 
whether subjects should be allowed to 
opt out of exempt research. 


A majority of comments received 
indicated that the final rule should 
maintain this exemption without any 
additional requirements. Commenters 
generally did not include explanation of 
this position. A small minority of 
commenters indicated that subjects 
should explicitly be provided the 
opportunity to opt out of this type of 
activity. In addition, a small minority of 
commenters indicated that subjects 
should be given notice before 
participation. One comment suggested 
that this exemption include ‘‘odor’’ 
evaluations as well. 


ii. Response to Comments and 
Explanation of the Final Rule: 
Exemption for Taste and Food Quality 
Evaluation and Consumer Acceptance 
Studies 


The final rule retains the exemption 
from the pre-2018 rule, which was 
proposed in the NPRM without any 
change, for taste and food quality 
evaluation and consumer acceptance 
studies. This exemption applies if 
wholesome foods without additives are 
consumed, or if a food is consumed that 
contains a food ingredient at or below 
the level and for a use found to be safe, 
or agricultural, chemical or 
environmental contaminant at or below 
the level found to be safe by FDA or 
approved by the Environmental 
Protection Agency or the Food Safety 
and Inspection Service of the U.S. 
Department of Agriculture. This 
exemption is retained unchanged from 
the pre-2018 rule. 


g. Secondary Research Use of 
Identifiable Private Information or 
Identifiable Biospecimens (or Storage or 
Maintenance for Such Secondary 
Research Use) for Which Broad Consent 
Is Required (§__—.104(d)(7) and (8)) 


The final rule includes two 
exemptions related to the secondary 
research use (including storage or 
maintenance for such use) of 
identifiable private information and 
identifiable biospecimens that require a 
subject’s broad consent. 


The first of these exemptions is in the 
final rule at § .104(d)(7), and applies 
to storing and maintaining identifiable 
private information or identifiable 
biospecimens for secondary research 
use. 





The second of these exemptions is in 
the final rule at § —_—.104(d)(8) and 
applies to the secondary research use of 
identifiable private information and 
identifiable biospecimens for specific 
secondary research studies. Secondary 
research under this exemption would 
generally be conducted with the 
information or biospecimens stored and 
maintained under the exemption at 
§ _.104(d)(7). 


Both of these exemptions for the 
secondary use of identifiable private 
information and identifiable 
biospecimens require broad consent and 
are discussed in detail below. As with 
the secondary use exemptions that do 
not require the subject’s broad consent 
(discussed above in Section V.3.d. of the 
preamble), the two exemptions at 
§ _.104(d)(7) and (8) are also limited 
to “secondary research.” These 
exemptions pertain only to research that 
involves re-using information or 
biospecimens that were or will be 
collected for some other “‘primary”’ or 
“initial” activity distinct from using 
them in secondary research. These 
exemptions do not cover any primary 
collections of either information or 
biospecimens. In other words, if an 
investigator wants to collect information 
directly from research subjects, for 
example, by asking them to complete a 
questionnaire, that would not be 
covered by these exemptions. Or if an 
investigator wants to collect 
biospecimens by having subjects swab 
their cheeks, that collection would 
similarly not be covered by these 
exemptions. On the other hand, an 
investigator who wants to use 
information that is in some databank, or 
to use biospecimens that are in a 
pathology laboratory, could use these 
exemptions, assuming all of the relevant 
conditions of the exemptions were met. 


i. Public Comments on the Proposed 
Exemptions for Secondary Research Use 
of Identifiable Private Information or 
Identifiable Biospecimens (or Storage or 
Maintenance for Such Secondary 
Research Use) for Which Broad Consent 
Is Required 


In combination, approximately 150 
comments discussed these proposals. 
Although commenters generally 
supported creating a pathway for low- 
risk research with biospecimens to 
occur without IRB review, a majority 
opposed the overarching proposal that 
these exemptions would, for the most 
part, be the only way (besides study- 
specific consent) for research with 
biospecimens to occur. Many of the 
arguments for and against these 
exemptions were outlined in section 
III.D, summarizing public comments 
received on the proposal to define 
“human subject” as including all 
biospecimens used in research, 
regardless of identifiability. 

Many commenters opposed the idea 
that the exemption should allow 
specific secondary studies involving 
biospecimens retained with identifiers 
to occur without IRB review. These 
commenters noted that IRBs are 
required to assess more than privacy 
and confidentiality protections, and 
whether informed consent was sought 
and obtained. Other commenters noted 
that by effectively encouraging the 
retention of identifiers with 
biospecimens (which would likely be 
required to track which specimens 
could be used in research at an 
institution), the NPRM proposals 
effectively introduced new privacy and 
confidentiality risks to subjects that did 
not exist under the pre-2018 rule. 

Some commenters who supported the 
expanded definition of human subject to 
include all biospecimens did not 
support these exemptions. These 
comments were mostly from members of 
the public and they generally argued 
that study-specific consent should be 
sought and obtained from subjects for 
every study involving that person’s 
biospecimens. These comments 
expressed concern that, with broad 
consent, investigators could still engage 
in research activities without the 
individuals’ knowledge. 

Several commenters expressed 
opposition to the NPRM proposal that 
the exemption could not be used if the 
investigator intended to return research 
results to subjects. These commenters 
saw this as a disincentive to return 
research results and also noted that it 
seemed at odds with existing law (e.g., 
HIPAA) and policy. Specifically, they 
argued, because patients are entitled 
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under HIPAA to the contents of their 
medical records, investigators must 
always be ready to return research 
results to subjects enrolled in their 
studies. 

The NPRM inquired about whether 
the proposed exemption was the best 
option, or whether there is a better way 
to balance respect for persons with 
facilitating research. Responses to this 
question were mixed, with a majority 
indicating that the proposed exemptions 
were not the best option. One comment 
indicated that broad consent would be 
reasonable if the consent was 
meaningful. 

Other commenters opposed the 
proposal as written. One felt it provided 
too little information and another found 
the language too complex and subject to 
misinterpretation. One institution 
asserted that the exemption would pose 
a burden on the research enterprise, 
would make a significant subset of 
studies impracticable, and would 
increase costs. 

Still other commenters indicated that 
consent should not be required for 
secondary research with biospecimens, 
noting that it was contradictory to 
determine that a type of research was 
exempt but still require consent, or that 
this exemption should not apply to 
state-mandated newborn DBS programs. 
One commenter suggested, ‘‘A far better 
option would be to include an 
exemption for the secondary research 
use of de-identified or nonidentified 
biospecimens, without the caveat of 
requiring a broad consent.”’ 

The NPRM requested public comment 
on whether and how the provision 
regarding the return of research results 
should be revised. Public comment was 
mixed in response to this question. 
Several comments indicated that the 
provision was too complex to follow. 

Comments that supported the 
provision about the return of research 
results in the proposed exemption 
stressed the complexity of decisions 
around returning results and many 
indicated support for required IRB 
review of investigators’ plans for 
returning research results. One 
professional organization also 
emphasized the need to communicate to 
potential participants during the 
informed consent process the policies 
concerning the return of individual 
research results. Many commenters also 
called for detailed OHRP guidance on 
this provision. 

One commenter suggested that the 
broad consent required when 
biospecimens are collected for storage 
for future research use include an 
indication as to whether potential 
subjects would like to be re-contacted 


with individual research results if 
applicable. 


Other commenters were opposed to 
the provision as written. One large 
health system indicated that the 
provision discourages researchers from 
returning research results to participants 
and from providing participants with 
easy access to their individual research 
data. The commenter emphasized that 
“Respecting research participants as 
partners obligates us to avoid the 
assumptions that researchers, an IRB, or 
even a panel of experts. . . know best.” 
The commenter went on to say: ‘‘While 
the NPRM suggests researchers cannot 
use the Common Rule as a shield from 
a request to deliver a designated record 
set upon request, the policy seems to 
discourage equitable research practices 
and allows informational disparities to 
continue. This does not serve the 
interest of justice.” 


In addition, one professional 
organization indicated concern that the 
provision might be interpreted by some 
to say that IRBs should not allow return 
of results, which it felt would create a 
bad situation. 


The NPRM sought comment on 
whether there should be an additional 
exemption that would permit the 
collection of biospecimens through 
minimally invasive procedures (e.g., 
cheek swab, saliva). A strong majority of 
commenters indicated no need for an 
additional exemption to permit the 
collection of biospecimens through 
minimally invasive procedures. One 
professional organization asserted that 
specimens should not be treated 
differently based on how they were 
collected. Other commenters indicated 
that obtaining specimens through 
minimally invasive procedures is 
similar to data collection and should be 
treated the same way. 


ii. Explanation of the Final Rule: 
Exemptions for Secondary Research Use 
of Identifiable Private Information or 
Identifiable Biospecimens (or Storage or 
Maintenance for Such Secondary 
Research Use) for Which Broad Consent 
Is Required 


(1) Exemption for the Storage or 
Maintenance for Secondary Use of 
Identifiable Private Information or 
Identifiable Biospecimens for Which 
Broad Consent is Required 


(§___.104(d)(7)) 


Section .104(d)(7) is an 
exemption for the storage or 
maintenance for secondary research use 
of identifiable private information or 
identifiable biospecimens. It requires 
that an IRB conduct limited IRB review 





to make the following determinations 
(required by §_.111(a)(8)): 

e Broad consent for storage, 
maintenance, and secondary research 
use of identifiable private information 
or identifiable biospecimens is obtained 
in accordance with the requirements of 
§ _.116(a)(1)-(4), and (a)(6), and (d); 

e Broad consent is appropriately 
documented or waiver of 
documentation is appropriate, in 
accordance with § _—.117; and 

e Ifa change is made for research 
purposes in the way the identifiable 
private information or identifiable 
biospecimens are stored or maintained, 
adequate provisions must be in place to 
protect the privacy of subjects and to 
maintain the confidentiality of data. 


This exemption is similar to the 
exemption proposed in the NPRM at 
§ _.104(f)(1), but it has been modified 
in some respects, and the operation of 
this exemption is also affected by other 
changes in the final rule that are 
different from the NPRM. Namely, the 
exemption has been modified to apply 
only to storage or maintenance for 
secondary research use of identifiable 
private information or identifiable 
biospecimens, because the final rule 
does not incorporate the NPRM 
proposal to alter the definition of a 
human subject to extend to research 
involving biospecimens regardless of 
their identifiability. This exemption was 
also modified given the decision not to 
adopt the privacy safeguards proposed 
inthe NPRM at § _.105. 

In addition, the Secretary’s template 
for broad consent is not being finalized 
for this exemption. Instead, institutions 
will have the flexibility to create their 
own consent forms that satisfy 
requirements at§ _—_—.116(a)(1)-(4), 
(a)(6) and (d) (see Section XIV). The 
consent form may be electronic. 

Given these changes from the NPRM 
proposal, the limited IRB review 
requirement for this exemption 
provided at § .111(a)(8) has been 
expanded in the final rule to require 
that the IRB make the following 
determinations, some of which are 
similar to those proposed in the NPRM. 

The final rule requires that for the 
exemption to apply, the IRB must 
determine that broad consent for 
storage, maintenance, and secondary 
research use of identifiable private 
information or identifiable 
biospecimens is obtained in accordance 
with the requirements of 
§ _.116(a)(1)-(4), (a)(6), and (d); This 
includes the requirement proposed in 
the NPRM that there be IRB review of 
the process through which broad 
consent will be obtained. 
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Also, given that we are not finalizing 
the proposed requirement to use the 
Secretary’s template for broad consent, 
the final rule includes in this 
requirement that an IRB determine that 
the broad consent includes the 
requirements and elements of consent in 
accordance with §__.116(a)(1)--4), 
(a)(6), and (d). 

The final rule also requires that the 
IRB determine that broad consent is 
appropriately documented or waived in 
accordance with § —_—.117. Although 
written broad consent generally will be 
required for this exemption to apply, the 
final rule also permits the exemption to 
apply when broad consent is obtained 
and an IRB has waived the 
documentation requirement for written 
informed consent under § _.117(c)(1). 

And because the proposed privacy 
safeguards proposed in the NPRM at 
§ _.105 are not included in the final 
rule, if a change will be made for 
research purposes in the way the 
identifiable private information or 
identifiable biospecimens are stored or 
maintained, the IRB must determine 
that when appropriate, adequate 
provisions are in place to protect the 
privacy of subjects and to maintain the 
confidentiality of data. This is the same 
IRB determination related to privacy 
and confidentiality that is required for 
nonexempt research. Importantly, this 
IRB determination is required only 
when a change is made for research 
purposes in the way the identifiable 
private information or identifiable 
biospecimens are stored or maintained, 
and only pertains to the aspects of 
storage and maintenance that are 
changed for research purposes. In this 
circumstance, the investigators are 
assuming responsibility for the manner 
in which the information and 
biospecimens are stored and 
maintained, and the IRB should be 
required to ensure that appropriate 
protections for the subjects are place 
with regard to the aspects of storage or 
maintenance that were changed for 
research purposes. 

If, on the other hand, no changes are 
being made for research purposes to the 
storage or maintenance, then this IRB 
determination does not apply. The 
institution storing and maintaining the 
information or biospecimens of course 
still has its responsibility to determine 
what protections distinct from those 
required by the Common Rule are 
appropriate, which may include other 
legal or regulatory safeguards or 
institutional policies. In light of 
application of such additional 
safeguards, it appears unnecessary to 
require additional protections through a 
requirement of this final rule simply 


because the individuals providing broad 
consent have agreed that their 
biospecimens or information could be 
used for research at some point in the 
future. And of course this provision 
regarding changes made for research 
purposes applies only when a Common 
Rule department or agency supports or 
conducts the research activity. 

Note that in many instances the only 
change that results from a person having 
signed a broad consent form for research 
relating to storing and maintaining that 
person’s biospecimens or information is 
that the institution that is already 
holding the biospecimens or 
information (for clinical purposes, for 
example) merely creates a record 
indicating that this person has signed 
such a consent form. The biospecimens 
and information could remain stored in 
whatever way (and for whatever period 
of time) that the institution had 
previously been storing them, based on 
the legitimate nonresearch or research- 
related reasons that the institution has 
used for initially collecting and storing 
those biospecimens and information. 
Any privacy and security protections 
(outside of the Common Rule) that 
already may apply to the institution’s 
information record-keeping or 
biospecimen preservation activities 
would continue to apply. The Common 
Rule’s protections would not apply 
before a change in storage or 
maintenance occurs for research 
purposes, but rather the institution 
would continue to operate in 
accordance with its pre-existing 
legitimate reasons for having and storing 
the biospecimens and information. The 
fact that the broad consent form has 
been signed does not by itself mean that 
there needs to be any alteration of what 
the institution is already doing with the 
biospecimens or information. 

Examples of changed aspects of 
storage or maintenance for research 
purposes that would require the IRB to 
find, before those changes go into effect, 
whether there are adequate provisions 
to protect the privacy of subjects and 
maintain the confidentiality of data 
include the following: If information or 
biospecimens are moved from one 
electronic or physical storage location to 
another due to considerations related to 
research plans; if information or 
biospecimens will be stored for longer 
than they otherwise would have been 
for the original purpose; if information 
or biospecimens are placed in a research 
registry or repository created to serve as 
a resource for investigators; or 
investigators are given electronic or 
physical access to the information or 
biospecimens. The relevant changes do 
not necessarily involve moving 


information or biospecimens from one 
location to another. Rather, the relevant 
changes include any change for research 
purposes that introduces or alters risks 
to the privacy or security of the stored 
information or biospecimens, including 
giving access to or transferring 
information or biospecimens for 
research purposes to someone who 
otherwise would not have access. 

The rationale for this exemption is 
that with the requirement for limited 
IRB review and the specified required 
IRB determinations, including subjects’ 
broad consent, this exemption respects 
subjects’ autonomy and provides 
appropriate privacy safeguards. More 
specifically, we believe that broad 
consent provides some measure of 
autonomy for individuals to decide 
whether to allow the research use of 
their identifiable private information or 
identifiable biospecimens, without 
imposing the kind of burden on 
investigators that would result from a 
requirement for specific informed 
consent for each secondary research 
study. We believe that it is appropriate 
to create a mechanism for broad consent 
for secondary research use, even if it 
involves the potential risk of having 
identifiers associated with the 
identifiable private information or 
identifiable biospecimens. We believe 
the administrative burden is also 
acceptable in order to allow for broad 
consent for secondary research use. 


(2) Exemption for Research Involving 
the Use of Identifiable Private 
Information or Identifable Biospecimens 
for Which Broad Consent is Required 
(§___.104(d)(8)) 


Section _.104(d)(8) is an 
exemption that also requires that broad 
consent has been obtained, and is for 
research involving the use of 
identifiable private information or 
identifiable biospecimens. This 
exemption will frequently be paired 
with the exemption at§ _.104(d)(7), 
which permits the storage and 
maintenance of identifiable private 
information and identifiable 
biospecimens for secondary research 
use. The exemption at§ _—.104(d)(8) 
would apply to a specific secondary 
research study, provided that the 
following criteria are met: 

e Broad consent for the storage, 
maintenance, and secondary research 
use of the identifiable private 
information or identifiable 
biospecimens was obtained in 
accordance with § _.116(a)(1)-(4), 
(a)(6), and (d); 

e¢ Documentation of informed consent 
or waiver of documentation of consent 
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was obtained in accordance with 
§ 117; 

e An IRB conducts a limited IRB 
review to make the determination 
required by § .111(a)(7), and to 
make the determination that the 
research to be conducted is within the 
scope of the broad consent; and 

e The investigator does not include 
returning individual research results to 
subjects as part of the study plan. 
However, it is permissible under this 
exemption to return individual research 
results when required by law regardless 
of whether or not such return is 
described in the study plan. 

This exemption could also apply if 
the investigator obtains appropriate 
broad consent from the subject in 
addition to the consent to an original 
specific study, and then proceeds to use 
the information or biospecimen in a 
secondary study. 

The exemption at § _.104(d)(8) is 
similar to the exemption proposed in 
the NPRM, but it has been modified in 
some respects. As with the exemption at 
§ _.104(d)(7), the operation of the 
exemption at§ _.104(d)(8) is also 
affected by other provisions in the final 
rule that are different from what was 
proposed in the NPRM. Namely, the 
exemption has been modified to apply 
only to storage or maintenance for 
secondary research use of identifiable 
private information or identifiable 
biospecimens because the final rule 
does not incorporate the NPRM 
proposal to alter the definition ofa 
human subject to extend to research 
involving biospecimens regardless of 
their identifiability. 

Due to the decision not to adopt the 
proposed privacy and security 
safeguards proposed in the NPRM at 
§ .105, this exemption was also 
modified to require that limited IRB 
review include an IRB determination 
that, when appropriate, adequate 
provisions are in place to protect the 
privacy of subjects and the 
confidentiality of data(§__.111(a)(7)). 
This is the same IRB approval criteria 
related to privacy and confidentiality 
that is required for nonexempt human 
subjects research. 

In addition, because the final rule 
does not include a broad consent 
template when a specific study has been 
proposed, it is required that the study be 
reviewed by an IRB to determine 
whether the proposed secondary 
analysis fits within the parameters of 
the broad consent that was obtained for 
secondary research use. 

We believe that the final rule’s 
requirement for limited IRB review of 
the privacy and confidentiality 
protections and the adequacy of the 








broad consent is responsive to 
commenters who believe that IRB 
oversight should be retained for the 
secondary research use of identifiable 
private information and identifiable 
biospecimens. 

We recognize commenters’ point that 
this exemption does not provide an 
incentive to investigators to provide 
individual research results to subjects, 
but we believe that the challenges of 
how and when to return such results 
warrant consultation with the IRB. We 
note that with the other revisions to the 
NPRM proposals, other options for 
research involving identifiable private 
information and identifiable 
biospecimens exist, which would be 
consistent with having plans for 
returning individual results. Although 
broad consent may include a statement 
that clinically relevant research results 
might be returned to subjects, we 
believe that when specific secondary 
studies include such a plan to return 
research results, it would almost always 
be appropriate for the study to be 
reviewed by an IRB, in part to better 
ensure that research results are 
disclosed to subjects in an appropriate 
manner. The only exceptions would be 
if the research qualified for another 
exemption, an IRB waived informed 
consent under § .116(e) or (f), or the 
research was carried out under a 
Secretarial waiver at§ _—.101(i). We 
expect that as part of the IRB’s review, 
the IRB would consider what subjects 
were told in the broad consent regarding 
the return of research results. 

It should be noted that the two 
exemptions in the final rule at 
§ _.104(d)(7) and (8) create additional 
options for investigators to conduct 
secondary research studies with 
identifiable private information. The 
final rule retains, largely unchanged, the 
options previously available to 
investigators in the pre-2018 rule. For 
instance, the final rule retains the pre- 
2018 criteria for requesting a waiver of 
consent in order to carry out those 
studies without obtaining consent. 
Moreover, secondary research using 
nonidentified biospecimens would not 
have to meet these requirements, 
because the final rule does not finalize 
the NPRM proposal to alter the 
definition of a human subject to include 
research involving nonidentified 
biospecimens under the rule. 


h. NPRM Proposal To Delete the Pre- 
2018 Rule’s Exemption for Surveys and 
Interviews of Public Officials 


The NPRM proposed to delete 
language found in the pre-2018 rule that 
exempted surveys and interviews with 
public officials. Approximately 100 





comments discussed this proposed 
deletion and it was almost universally 
opposed. Political science professors, 
students, researchers, and academics 
from other disciplines generally 
addressed this deletion. 

Comments argued that this deletion 
would have a chilling effect on political 
science research and might make 
political science researchers more 
vulnerable to law suits. Other comments 
noted that public officials are generally 
treated differently in numerous laws, 
and it is in fact appropriate for the 
Common Rule to have a different 
standard for surveys and interviews 
with public officials. Comments also 
suggested that this deletion could 
negatively affect the public’s ability to 
hold public officials accountable for 
their actions. One commenter suggested 
that instead of deleting this exemption, 
a final rule might consider explicitly 
limiting this exemption to studies that 
relate to the public officials in their 
official capacity. 

The final rule removes the exemption 
category in the pre-2018 rule at 
§ _.101(b)(3)(i), which pertained to 
research involving the use of 
educational tests, survey procedures, 
interview procedures, or observation of 
public behavior, if the human subjects 
are elected or appointed public officials 
or candidates for public office, or if 
federal statute requires without 
exception that the confidentiality of the 
personally identifiable information will 
be maintained throughout the research 
and thereafter. We note that many of the 
public comment concerns are addressed 
by other provisions in the final rule. 
Almost all of the research activities in 
this category would already be 
exempted under the final rule at 
§ _.104(d)(2), without needing to 
single out elected or appointed officials 
as being treated differently in this way. 
If the research is designed to provide 
sensitive generalizable knowledge about 
officials, then the identifiable private 
information obtained should be kept 
confidential as required by this final 
rule. If the purpose of the activity is in 
fact designed to hold specific elected or 
appointed officials up for public 
scrutiny, and not keep the information 
confidential, such an activity is not 
considered research under the provision 
at§ —_-.102(1)(2). 

Thus, the final rule adopts the NPRM 
proposal. 


i. NPRM Proposal To Exempt Secondary 
Research Use of Identifiable Private 
Information Where Notice Was Given 


One exemption proposed in the 
NPRM is not included in the final rule. 
Note that exclusions proposed in the 
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NPRM and not included in the final rule 
also are described in Section IIL1.4 of 
this preamble. 

The NPRM proposed to exempt 
certain secondary research activities 
involving identifiable private 
information where notice of such use 
had been given. The proposed 
exemption was included, in part, to be 
responsive to section 511 of the 
Medicare Access and CHIP 
Reauthorization Act of 2015 (MACRA), 
which requires the Secretary to issue a 
clarification or modification with 
respect to the application of these 
regulations to certain activities 
involving clinical data registries. The 
preamble for the Common Rule NPRM 
noted ‘‘. . . this exemption category 
might allow certain research activities of 
these clinical data registries not 
otherwise covered by the proposed 
HIPAA-related exclusion (i.e., when the 
clinical data registries are not part of a 
HIPAA covered entity or acting as a 
business associate), such as when a 
clinical data registry may receive 
information from a health care entity for 
research purposes.” 

Approximately 70 comments 
discussed this proposal, with the vast 
majority from institutions. A minority of 
commenters (14) supported the NPRM 
proposal as drafted. In addition, 11 
commenters who did not indicate 
whether they supported the inclusion of 
this proposal in a final rule asked 
questions about implementation and the 
meaning of ‘“‘notice’’ under this 
proposal. 

A majority of commenters (41) 
opposed the proposal as drafted in the 
NPRM, citing a variety of conflicting 
reasons: 

e Sixteen commenters felt that the 
NPRM proposal was too permissive as 
drafted, and that it would not provide 
adequate protections to prospective 
subjects. Many of these commenters also 
suggested that the proposal as drafted 
did not respect subject autonomy 
interests sufficiently in not providing 
subjects with an ability to opt out. They 
indicated that the exemption might be 
acceptable if additional requirements 
(such as subject opt out), or additional 
limitations (such as limiting the 
nonresearch information to which this 
exemption applies to data governed by 
certain privacy-oriented laws) were 
implemented. 

e Fourteen commenters felt that the 
NPRM proposal was too restrictive, and 
that as drafted it would not achieve the 
stated goal of reducing administrative 
burden on IRBs. These commenters 
specifically discussed the 
implementation burdens involved in 
providing notice to prospective subjects. 


These commenters also noted that 
providing an option to opt out would be 
very burdensome to IRBs and 
investigators, an outcome that seemed 
counter to the justifications the NPRM 
provided for this exemption. 

e Five commenters felt that the type 
of research encompassed by this 
proposal should not be exempted from 
the Common Rule, and that IRB review 
or informed consent should be required 
instead. 

Approximately 25 comments 
discussed whether the NPRM proposal 
was necessary to enable activities 
involving qualified clinical data 
registries. A majority of these comments 
indicated that because the activities 
would be subject to the HIPAA 
regulations, protection of subjects 
would not be enhanced by the proposed 
NPRM exemption. Several commenters 
pointed out that qualified clinical data 
registries also might qualify for 
exclusion under the NPRM proposal at 
101(b)(2)(ii). Additional comments 
suggested that other NPRM exemptions 
and exclusions would cover activities 
with qualified clinical data registries 
without commenting on which 
exemptions and exclusions applied. 

The NPRM included the exemption at 
§ _.104(e)(2), in part, to be responsive 
to section 511 of MACRA, but 
commenters expressed little support for 
this exemption, even for activities 
carried out by clinical data registries. 
Section 511 of MACRA has directed the 
Secretary of HHS to issue a clarification 
or modification with respect to the 
application of the Common Rule to 
activities involving clinical data 
registries, including quality 
improvement activities. With this final 
tule, the Secretary of HHS is providing 
that clarification here. Because clinical 
data registries are created for a variety 
of purposes, and are designed and used 
in different ways, there is no simple, 
single answer regarding how the 
Common Rule applies to clinical data 
registries. The Secretary of HHS has 
received advice from SACHRP on this 
topic, and SACHRP recommended that 
the pre-2018 rule was adequate to apply 
to clinical data registries without those 
registries being given any distinctive 
status. The Secretary of HHS believes 
that the same is true for the final rule, 
and so has not created a specific 
provision for clinical data registries. 

The final rule does not impose any 
requirements on a large portion of the 
activities related to clinical data 
registries. The following points are 
important: First, the rule does not apply 
to clinical data registry activities not 
conducted or supported by a Common 
Rule department or agency. Second, 


many clinical data registry activities, 
including many quality improvement 
activities, do not meet the definition of 
research, and so the Common Rule does 
not apply. For example, the creation of 
a clinical data registry designed to 
provide information about the 
performance quality of institutional care 
providers, and whose design is not 
influenced or altered to facilitate 
research, is not covered by this rule 
even if it is known that the registry will 
be used for research studies. Third, the 
Common Rule does not apply to a 
clinical data registry research study that 
only involves obtaining and analyzing 
nonidentified information because that 
activity would not involve a “human 
subject’’ as defined by the rule. Fourth, 
some Clinical data registry research 
activities may qualify for exemption 
under the proposed provision at 

§ _.104(d). Fifth, if an institution 
solely releases identifiable private 
information that was obtained in the 
course of patient clinical care to a 
clinical data registry for research, that 
institution is considered to be not 
engaged in human subjects research, 
and no requirements of the rule apply 
to that institution. 

In contrast, if investigators receive 
funding from a Common Rule 
department or agency to design a 
clinical data registry for research 
purposes and the registry includes 
identifiable private information, or 
involves interacting with individuals 
(e.g., a research survey), then such an 
activity involves human subjects 
research, but may be exempt if it meets 
one or more of the exemption categories 
under § _.104(d)(7). Similarly, if 
investigators use federal support to 
obtain identifiable private information 
from a clinical data registry to conduct 
a research study, then such secondary 
research use of clinical registry 
information would involve human 
subjects research and the requirements 
of the rule would apply, although the 
research may qualify for exemption 
under § .104(d)(8). This is 
comparable to how the rule applies to 
a research study that involves chart 
review of identifiable private 
information drawn directly from 
hospital medical records. 


VI. Protection of Identifiable Private 
Information and Identifiable 
Biospecimens 


A. Background and Pre-2018 
Requirements 





Increasing research use of genetic 
information, information obtained from 
analysis of biospecimens, and the ability 
to more easily merge multiple sources of 
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administrative and survey datasets (e.g., 
medical records, claims data, vital 
records, and information about lifestyle 
behaviors from surveys) are some 
examples of how advances in research 
have increased the risks of data breaches 
that reveal identifiable private 
information. For example, the 
unauthorized release or use of 
information about subjects such as the 
disclosure of Social Security or 
Medicare numbers may pose financial 
risks, and disclosure of illegal behavior, 
substance abuse, or chronic illness 
might jeopardize subjects’ current or 
future employment, or cause emotional 
or social harm. 

Based on questions from and 
conversations with members of the 
regulated community, we are aware that 
IRBs are not always equipped with the 
expertise needed to evaluate risks to 
privacy and confidentiality, specifically 
regarding sophisticated IT security. 
However, we note that no data suggest 
that IRBs are currently approving 
research without requiring appropriate 
privacy and confidentiality safeguards. 
Despite this, we recognized that setting 
standards could assure appropriate 
privacy and confidentiality 
consideration and consequent 
protections to all research subjects, 
without the administrative burden of 
needing a specific committee review of 
the privacy and confidentiality 
protections of each study. To that end, 
the 2011 ANPRM suggested establishing 
mandatory data security and 
information protection standards for all 
studies that involve the collection, 
generation, storage, or use of identifiable 
or potentially identifiable information 
that might exist electronically or in 
paper form or be contained ina 
biospecimen. It put forward the idea 
that these standards might adopt the 
categories used in the HIPAA Rules and 
asked a series of questions about how 
best to protect private information. 


B. NPRM Proposal 


A goal of the NPRM was to ensure 
that researchers protect the privacy of 
their participants and the security of the 
data, calibrated to the likelihood of 
identifiability and sensitivity of the 
information being collected. The NPRM 
proposed to require that investigators 
and institutions conducting research 
subject to the Common Rule implement 
reasonable safeguards for protecting 
against risks to the security or integrity 
of biospecimens or identifiable private 
information. Given the significant 
concerns of public commenters about an 
idea discussed in the 2011 ANPRM of 
adopting the standards solely modeled 
on certain standards of the HIPAA 


Rules, the NPRM proposed several sets 
of standards, and allowed a choice 
about which set to use. 

First, the NPRM proposed that the 
Secretary of HHS could publish a list of 
specific measures that an institution or 
investigator could use to meet the 
security requirements. The list would be 
evaluated and amended, as appropriate, 
after consultation with other Common 
Rule departments and agencies. The 
proposed list would be published in the 
Federal Register, and public comment 
on the proposed list would be sought 
before the list was finalized. 

The specific safeguards that would be 
identified by the Secretary would be 
designed so that they could be readily 
implemented by the individual 
investigator, and could build on existing 
safeguards already in place to protect 
research data. These standards would 
include security safeguards to assure 
that access to physical biospecimens or 
data is limited only to those who need 
access for research purposes. The 
standards would also assure that access 
to electronic information is authorized 
only for appropriate use. Finally, the 
safeguards, collectively referred to as 
“privacy safeguards,” would assure that 
information and biospecimens posing 
informational risks to subjects would be 
protected according to appropriate 
standards. 

Second, the NPRM proposed that if an 
institution or investigator is currently 
required to comply with the HIPAA 
rules, then the safeguards required by 
the Common Rule would be satisfied. 
No additional requirements were 
proposed to protect information subject 
to the HIPAA Rules. The NPRM also 
proposed to clarify that the proposed 
provisions would not amend or repeal 
the requirements of 45 CFR parts 160 
and 164 for the institutions or 
investigators to which these regulations 
apply pursuant to 45 CFR 160.102. 
Institutions or investigators that are not 
required to follow HIPAA could 
voluntarily implement the HIPAA Rules 
and be considered as satisfying the 
proposed requirements. The NPRM also 
proposed that for federal departments 
and agencies that conduct research 
activities that are or will be maintained 
on information technology that is 
subject to and in compliance with 
section 208(b) of the E-Government Act 
of 2002, 44 U.S.C. 3501 note, if all of the 
information collected, used, or 
generated as part of the activity will be 
maintained in systems of records subject 
to the Privacy Act of 1974, 5 U.S.C. 
552a, and the research will involve a 
collection of information subject to the 
Paperwork Reduction Act of 1995, 44 


U.S.C. 3501 et seq., the requirements 
would be satisfied. 

For purposes of informing the 
development of the proposed privacy 
safeguards, the NPRM sought comment 
on the types of safeguards that would be 
appropriate for the Secretary’s list. The 
NPRM also noted that additional 
statutes or acts mandate the protection 
of privacy and confidentiality of 
identifiable private information. It might 
be reasonable to include these as 
additional standards that would meet 
the proposed requirement if they were 
met in research that is subject to those 
standards or for which an investigator or 
institution has voluntarily elected to 
comply. Public comment was sought on 
whether any of these existing statutes or 
acts would serve the goals of proposed 
privacy safeguards. 

The NPRM also included conditions 
for use and disclosure of research 
information to other entities. It required 
that protections be in place when a 
biospecimen or identifiable private 
information is shared for appropriate 
research or other purposes. Unless 
required by law, the NPRM proposed to 
limit the re-disclosure of identifiable 
private information or release of 
biospecimens obtained for research. 

The NPRM asked for feedback on 
whether limiting re-disclosure to four 
specific circumstances unless such a 
disclosure was “‘required by law” would 
be too restrictive, or whether more 
permissive standards would better 
facilitate the NPRM goal of fostering the 
secondary research use of information. 
The NPRM also whether the proposed 
limitations on re-disclosure were more 
or less restrictive than necessary and 
whether there should be additional 
purposes for which release of 
biospecimens or re-disclosure of 
identifiable private information would 
be permitted should be allowed. 

The NPRM justified this change by 
arguing that its benefit would be that 
IRBs would not be required to review 
the individual plans for safeguarding 
information and biospecimens for each 
research study. Although the NPRM 
presumed that the proposed privacy 
safeguards would be sufficient, an IRB 
could determine that a particular 
activity would require more than what 
was proposed. Once IRBs became 
familiar with standard institutional and 
investigator-adopted protections, the 
NPRM anticipated that they would 
become more comfortable with the fact 
that they need not review every protocol 
for privacy safeguards. In addition, it 
was expected that if the proposed 
privacy safeguards were adopted, 
overall reduction in regulatory burden 
would occur because IRBs would not 
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have to review security provisions on a 
case-by-case basis. 

Finally, as discussed in Section V, the 
NPRM contained proposed exemptions 
that would have permitted a larger 
number of protocols to proceed without 
IRB review if specific conditions were 
met, conditioned on investigators and 
institutions also meeting the proposed 
privacy and security requirements. Note 
that there was no requirement for an IRB 
to determine whether investigators were 
adhering to the privacy safeguards for 
such exempt research. 


C. Public Comments 


Approximately 130 comments 
addressed the privacy safeguards, with 
a majority generally supporting the 
proposal. Both those who supported the 
proposal and those who opposed it 
indicated that it was difficult to 
comment on the adequacy of privacy 
standards that had yet to be developed. 

Those who supported the proposal 
stated that having standardized, 
minimum safeguards would create more 
consistency across IRBs in how 
biospecimens and identifiable private 
information are protected. Those who 
were opposed to the proposal stated that 
patient information is already covered 
by HIPAA security standards and 
student records are already covered by 
FERPA, arguing that these plus an array 
of other standards cover financial and 
various other types of sensitive 
information, making inclusion in the 
Common Rule redundant. 

However, several comments asserted 
that the HIPAA standards, while 
appropriate for health information, 
would not be appropriate for other types 
of research data. Others noted that the 
wide range and nature of research 
makes it too challenging to develop a 
blanket standard. With regard to 
applying the standards to exempt 
research, one large association of 
research universities, medical centers, 
and independent research institutes 
argued that research covered by the 
proposed exempt or excluded categories 
should be low risk and therefore third 
party evaluation of privacy safeguards 
was not needed. Several academic 
research institutions urged that if the 
security and privacy requirements were 
included in the final rule, then the 
measures should be as simple as 
possible. For example, they suggested 
developing a single set of standards for 
all identifiable data rather than 
calibrating the safeguards to the 
sensitivity of the information to be 
collected. 

A few comments addressed the 
proposed re-disclosure criteria. Of these, 
a majority indicated concerns with the 


NPRM redisclosure provision. Most of 
the opposition was specifically aimed at 
imposing the sharing criteria for 
nonidentified biospecimens. These 
commenters indicated that for sharing 
nonidentified biospecimens, imposing 
HIPAA-like privacy safeguards was 
unnecessary and would be extremely 
burdensome. Several comments 
suggested that the Common Rule adopt 
the same permissible uses and 
disclosures of information without 
authorization that exists under HIPAA. 

One scientific professional 
organization and more than 60 
institutions endorsing its comments 
noted that specific redisclosure 
considerations should exist for 
identifiable biospecimens, stating that 
redisclosure of the identity of the source 
of a biospecimen is appropriate in rare 
situations in which a confirmed 
research finding may have a significant 
impact on the health of the donor of the 
specimen. A large, private higher 
education institution noted that the 
limitations on use, release, and 
disclosure as proposed seemed at odds 
with the permissible uses and 
disclosures allowed under HIPAA. 

Others suggested that the language 
stating that biospecimens or identifiable 
private information could be released 
for any lawful purpose with the consent 
of the subject was too open-ended and 
permissive. One data privacy and 
security advocacy group also noted that 
the introductory language to the 
proposed safeguards could be read as 
requiring an investigator to release 
research biospecimens or disclose 
identifiable private information upon 
receipt of a valid request, as opposed to 
simply permitting an institution to do 
so. One academic research organization 
suggested an alternative approach—that 
the Federal Government clarify that 
institutions and networks may designate 
specialized privacy and security boards 
to review safeguards. 


D. Response to Comments and 
Explanation of the Final Rule: Privacy 
and Security Protections 


The final rule does not adopt the 
privacy and security protections 
proposed in the NPRM, but rather 
retains and acknowledges the IRB’s role 
in ensuring that privacy safeguards are 
appropriate for the research studies that 
require IRB review. To better ensure that 
appropriate privacy protections are 
required by IRBs, the final rule includes 
a new provision in the IRB review and 
approval criteria at § —_.111(a)(7)(i) 
that requires the Secretary of HHS in 
consultation with OMB and the 
Common Rule departments and 
agencies to issue guidance o assist IRBs 


in assessing what provisions are 
adequate to protect the privacy of 
subjects and to maintain the 
confidentiality of data. This requirement 
is discussed in more detail in Section 
XI. 

Although we continue to believe that 
appropriately protecting the privacy of 
human subjects who provide 
identifiable private information and 
identifiable biospecimens as well as 
preventing security breaches is critically 
important, we agree with the public’s 
concerns about requiring adherence to 
privacy and security standards when the 
safeguards to be issued by the Secretary 
of HHS have yet to be developed. The 
federal privacy and security laws would 
apply only to certain federally 
conducted research. Rather than 
promulgate a regulation that lacked 
sufficient specificity, we determined it 
would be preferable to maintain the 
requirement that IRBs review research 
studies to ensure that appropriate 
privacy and security safeguards are in 
place to protect research subjects, but 
include a commitment that the 
Secretary of HHS will issue guidance to 
assist IRBs in appropriately protecting 
subjects’ privacy and confidentiality. 
This guidance would take into 
consideration, among other things, the 
level of identifiability and sensitivity of 
the information being collected. 
Although IRBs were not specifically 
designed to evaluate risk to privacy and 
confidentiality and the adequacy of 
safeguards to protect against those risks, 
IRBs have been responsible for 
evaluating such risks under the pre- 
2018 rule. We believe that guidance in 
this complex and evolving area will 
assist IRBs to identify appropriate 
protections, and may be better able than 
standardized protections, to address the 
variety of privacy and confidentiality 
concerns that arise in the broad range of 
research studies that are being carried 
out now and those that will be 
conducted in the years to come. 

As discussed in Section V, certain 
NPRM exemption proposals required 
the application of the NPRM’s proposed 
safeguards in whole or in part. To 
accommodate the fact that the final rule 
does not include the privacy safeguards, 
exemption categories in the final rule 
that are predicated on the need for some 
type of privacy safeguards will instead 
require that an IRB conduct a limited 
review to ensure that adequate 
provisions are in place to protect the 
privacy of subjects and to maintain the 
confidentiality of data. 

The final rule exemptions subject to 
this limited IRB review requirement are: 

e The exemption for research that 
includes only interactions involving 
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educational tests, survey procedures, 
interview procedures, or observations of 
public behavior regardless of the 
identifiability or sensitivity of the 
information collected/recorded 
(§___.104(d)(2) (ii); 

e The exemption for research 
involving benign behavioral 
interventions in conjunction with the 
collection of information from an adult 
subject through verbal or written 
responses or video recording (regardless 
of the identifiability or sensitivity of the 
information collected/recorded 
(§__.104(d)(3)(4)(C)); 

e The exemption for the storage or 
maintenance of identifiable private 
information or identifiable 
biospecimens for which broad consent 
is required, when there is a change 
specific to the research activity in how 
the identifiable private information or 
identifiable biospecimens are stored and 
maintained (§__—.104(d)(7)); and 

e The exemption for the secondary 
research use of identifiable private 
information or identified biospecimens 
for which broad consent is required 


(§___.104(d)(8)) 


VII. IRB Membership and Modification 
to References to Vulnerability 





(§§ .107(a), .111(a)(3), and 
.111(b)) 

A. Background and Pre-2018 

Requirements 


The pre-2018 rule stipulated a 
condition of IRB membership at 
§ _.107(a) stating that IRBs should 
aim for membership that does not 
consist entirely of individuals of one 
gender, race, or cultural background. It 
referred again to the characteristics of 
IRB members at § _.107(b), stating 
that efforts should be made to ensure 
that no IRB consists entirely of members 
of one gender or one profession. 

The pre-2018 rule also referred to the 
concept of vulnerability and 
consideration of vulnerable populations 
in three provisions, one of which 
pertained to IRB membership 
(§__.107(a)), one with regard to 
selection of subjects (§__.111(a)(3)), 
and one with regard to additional 
protections needed for subjects 
vulnerable to coercion or undue 
influence (at § _.111(b)). Under the 
pre-2018 rule, only § —_—.111(b) of the 
three provisions specifically referred to 
vulnerability to coercion or undue 
influence as the type of vulnerability 
that should be considered. In addition, 
of these same three provisions in the 
pre-2018 rule, only § —_—.107(a) 
identified “handicapped” individuals as 
a vulnerable category of subjects. 


B. NPRM Proposal 


The NPRM proposed eliminating the 
pre-2018 rule stipulation that IRBs 
should aim for membership that does 
not consist entirely of individuals of one 
gender or profession because the 
requirement that IRB membership 
reflect members of varying backgrounds 
and diversity, including gender, 
accomplishes the same goal. 


Further, the NPRM proposed that the 
criterion at § .111(a)(3) be revised to 
align with the language of §_—_—.111(b) 
to reflect that the vulnerability of the 
populations in these research studies 
should be considered to be a function of 
the possibility of coercion or undue 
influence, and that this vulnerability 
alone should be the IRB focus of 
concern with respect to this criterion. 
The proposed change was intended to 
provide greater consistency and clarity 
in IRB consideration of vulnerability of 
subject populations in research 
activities and appropriate protections. A 
comparable change was also proposed at 
§ _.107(a), pertaining to IRB 
membership. 


In addition, the NPRM proposed that 
the term ‘‘handicapped” be changed to 
“physically disabled” individuals. 
Therefore, to enhance consistency and 
clarity among these three provisions, it 
was proposed that the term “physically 
disabled” be inserted at § _.111(a)(3) 
and (b). This would mean that 
physically disabled persons would be 
among the individuals that the IRB may 
consider in determining that the 
selection of subjects is equitable 
(§__—.111a)(3)), and that the IRB may 
consider to be vulnerable to coercion or 
undue influence (§___.111(b)). Public 
comment was sought on whether 
pregnant women and those with 
physical disabilities should be 
characterized as vulnerable to coercion 
or undue influence. Whether or not 
these subpopulations are considered 
vulnerable to coercion or undue 
influence would not affect the 
applicability of subpart B. 


Finally, the NPRM proposed a change 
in § .107(a), involving the insertion 
of “economically or educationally 
disadvantaged persons’ as an example 
of a vulnerable population, and 
requiring an IRB to give consideration to 
membership expertise in this area. This 
language was already included in the 
pre-2018 rule at§ —_.111(a)(3) and 
§ _.111(b). Adding this category of 
individuals to those who may be 
considered vulnerable to coercion or 
undue influence at § _—.107(a) was 
intended to create greater consistency 
among these three provisions. 








C. Public Comments 


Between 40 and 50 NPRM comments 
discussed the language describing 
vulnerable populations found in 
§§ __.107(a), .111(a)(3), and (b). A 
majority of these comments only 
discussed the inclusion of pregnant 
women as an example of a population 
that might be vulnerable. Typically, 
comments addressed only one of the 
three questions posed in the NPRM 
about these provisions. The questions 
asked whether the § _.111(a)(3) and 
(b) focus on issues related to coercion or 
undue influence in research with 
vulnerable populations, and no other 
considerations related to vulnerability, 
was appropriate; whether pregnant 
women and those with physical 
disabilities should be included in the 
category of subpopulations that may be 
vulnerable to coercion or undue 
influence; and, whether populations 
should be considered vulnerable for 
reasons other than vulnerability to 
coercion or undue influence. 

A majority of the comments stated 
that the inclusion of pregnant women as 
an example of a group that might be 
vulnerable to coercion or undue 
influence was inappropriate. These 
commenters noted that to suggest that 
noncognitive limitations make 
individuals inherently vulnerable is 
insulting to those populations. Of those 
comments that addressed these 
proposals, a minority discussed whether 
individuals with physical disabilities 
should be included as an example of a 
group that might be vulnerable to 
coercion and undue influence. As with 
pregnant women, these commenters 
stated that the insinuation that groups 
with physical disabilities might be 
inherently vulnerable to coercion and 
undue influence was insulting. One 
commenter noted that a physical 
condition might make one vulnerable to 
coercion or undue influence in the 
research context, but typically only 
when the research activity targets that 
vulnerability (as opposed to those 
populations always being vulnerable). 

In terms of whether other types of 
vulnerabilities should be considered by 
IRBs, public comment was mixed. Some 
commenters indicated that in the 
research context, the specific concerns 
with respect to vulnerable populations 
are limited to vulnerability to coercion 
and undue influence, while others 
noted that the regulations do not 
preclude an IRB from considering other 
types of vulnerability and that because 
of this flexibility, additional regulatory 
text was not necessarily needed. Groups 
specifically concerned with issues 
related to research involving Native 
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American populations noted that there 
are issues broader than vulnerability to 
coercion and undue influence that 
should be considered, such as 
vulnerability to group harms; one 
commenter recommended that 
populations be considered vulnerable as 
a result of being historically 
marginalized, such as native/tribal 
communities; lesbian, gay, bisexual, and 
transgender (LGBT) individuals; and 
racial and ethnic groups. 

Commenters who disagreed with this 
change generally felt that a history of 
societal marginalization, such as that 
experienced by LGBT groups or AI/AN 
tribes, should be a basis for determining 
vulnerability, and that a focus on only 
coercion or undue influence may be 
insufficient for IRB consideration. 

Several comments discussed the fact 
that using the term mentally disabled is 
potentially patronizing. One commenter 
suggested that instead of listing 
mentally disabled individuals as a 
group that might be vulnerable to 
coercion and undue influence, the 
regulations should use the term 
“populations with impaired decision 
making ability.’’ This suggestion echoes 
a recommendation made by SACHRP in 
2009 as well.36 

Another commenter stated that 
vulnerability status should be based on 
situational context, not on membership 
in a population, which potentially 
promotes stigmatization. Rather, focus 
should be more on the risk of the 
research and the situation of each 
subject when asked to participate in 
research. Finally, it was suggested that 
terminally ill patients who have 
exhausted all standard therapies, and 
possibly other research interventions, 
should be considered vulnerable. 


D. Response to Comments and 
Explanation of the Final Rule: 
References to Vulnerability 


A majority of comments agreed that 
the focus on issues related to coercion 
or undue influence, and no other 
considerations related to vulnerability, 
was appropriate. We agree with this 
assessment, and have retained this 
language in the final rule. We believe 
this change will help guide IRBs when 
assessing the type of vulnerability that 
should be the focus of review. We note 
thatthe § —_.111(a)(3) approval 
criterion retains the reference to the 
purposes of the research and the setting 
in which it is conducted because these 
considerations are also relevant to the 


36 HHS. SACHRP. Attachment: Recommendations 
Regarding Research Involving Individuals with 
Impaired Decision-making (2008, 2009). Retrieved 
from http://www.hhs.gov/ohrp/sachrp-committee/ 
recommendations/2009-july-15-letter-attachment/#. 


assessment of the equitable selection of 
subjects, and may include factors such 
as societal marginalization or 
discrimination. 

The language at the three provisions 
(§_—«.107(a),§  —.111a)(3), and 
§ _.111(b)) has been made identical 
in referring to vulnerability as meaning 
vulnerability to coercion and undue 
influence, in recognition that coercion 
or undue influence refers to the ability 
to make an informed decision about 
participating in research. 

We agree with comments that said 
that the list of example vulnerable 
populations listed in the pre-2018 rule 
is out of date. 

In agreement with the majority of 
comments, the final rule no longer 
includes pregnant women or 
“handicapped” or physically disabled 
individuals as examples of populations 
that are potentially vulnerable to 
coercion or undue influence. Adopting 
a suggestion from public comment and 
SACHRP, the final rule uses the term 
“individuals with impaired decision- 
making ability” to replace the term 
“mentally disabled persons.” 


VIII. IRB Functions and Operations 
(§ .108) 


A. Background and Pre-2018 
Requirements 


The pre-2018 rule outlined IRB 
functions and operations at §§ .103 
and 108. 


B. NPRM Proposals 


The NPRM contained several 
proposals for changes in IRB functions 
and operations. Of relevance here, the 
requirements for recordkeeping by IRBs 
would no longer appear in § .103 of 
the rule but in § .108. Much of the 
discussion related to these changes 
appears in Section IV regarding the 
assurance process. The issues are 
summarized here. 

The NPRM proposed that the 
requirement that a written assurance 
include a list of IRB members for each 
IRB designated under the assurance 
process be replaced. In its place, the 
NPRM proposed that the assurance 
include a statement for each designated 
IRB, prepared and maintained by the 
institution, or when appropriate the 
IRB, with a current detailed list of the 
IRB members including information 
sufficient to describe each member’s 
chief anticipated contributions to IRB 
deliberation; and any employment or 
other relationship between each 
member and the institution. The 
regulatory requirement at 
§ _.103(b)(3) that changes in IRB 
membership be reported to the 








department or agency head, or to OHRP 
when the existence of an HHS-approved 
assurance is accepted, would be deleted, 
eliminating the requirement. Instead, an 
institution would be required under 
proposed § _.108(a)(2) to maintain a 
current IRB roster, but such a roster 
would not need to be submitted to 
OHRP or other agency managing the 
assurance of compliance process. 

The NPRM also proposed to eliminate 
the requirementin § __.103(b)(2) that 
an institution designate one or more 
IRBs on its FWA established in 
accordance with the Common Rule. The 
requirement in the pre-2018 Common 
Rule at § —_.103(b)(2) that IRBs have 
sufficient meeting space and staff to 
support IRB reviews and record keeping 
requirements was moved in the NPRM 
to§ _.108(a)(1). Note that under this 
proposal federal departments or 
agencies would retain the ability to ask 
for information about which IRBs 
review research conducted at an 
institution as part of the assurance 
process. 


C. Public Comments 


Approximately 10 comments were 
received on these proposals. Of those, 
all supported the NPRM proposal that 
changes in IRB membership no longer 
needed to be reported to the funding 
department or agency. All commenters 
supported the proposal that IRBs would 
simply need to prepare and maintain a 
current list of IRB members. 
Commenters agreed that the proposed 
changes to the IRB roster requirement 
would reduce administrative burden 
without having any significant impact 
on the protection of human subjects. 
Those who commented on the proposed 
deletion of the requirement to designate 
one or more IRBs on an institution’s 
FWA generally supported the proposal. 

No comments were received on the 
proposed movement of IRB policy and 
recordkeeping requirements from 
§ _.103to§ _.108. 


D. Explanation of the Final Rule: IRB 
Functions and Operations 


The final rule adopts the NPRM 
proposals to move the IRB 
recordkeeping requirements from 
§ _.103(b)(3), (4), and (5) to 
§ _.108(a)(2), (3), and (4). (See 
Section IV regarding changes to 
§ .103 as well.) The final rule also 
adopts the NPRM proposal that IRBs 
must maintain an accurate list of IRB 
members but are not required to submit 
changes to that roster to the funding 
department or agency. The final rule 
also adopts the NPRM proposal to delete 
the requirement in the pre-2018 rule 
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that institutions designate one or more 
IRBs on that institution’s FWA. 


IX. IRB Review of Research (§ .109) 


A. Background and Pre-2018 
Requirements 


The pre-2018 rule listed four areas of 
responsibility for IRBs in the review 
process concerning their authority to 
approve, request modification, or 
disapprove research activities; ensure 
informed consent requirements are met 
(including documentation or waiver, as 
relevant); notify investigators of their 
determinations; and conduct continuing 
review of research. The rule at 
§ _.109(a) stated that IRBs have the 
authority to carry out these 
responsibilities for all research activities 
covered by the policy. 

In particular, the pre-2018 rule at 
§ _.109(e) required that IRBs conduct 
continuing review of research covered 
by this policy at intervals appropriate to 
the degree of risk, but not less than once 
per year. Except when an expedited 
review procedure was used, continuing 
review of research was to occur at 
convened meetings at which a majority 
of the IRB members are present, 
including at least one member whose 
primary concerns are in nonscientific 
areas. 

An IRB could use an expedited review 
procedure to conduct continuing review 
of research for some or all of the 
research appearing on the list of 
research eligible for expedited review 37 
and found by the reviewer(s) to involve 
no more than minimal risk. The 
Common Rule departments and 
agencies could restrict, suspend, 
terminate, or choose not to authorize an 
IRB’s use of the expedited review 
procedure (§___—.110(d)). 


B. NPRM Proposals 


The NPRM proposed clarifying that 
the Common Rule does not give IRBs 
the authority to review or approve, 
require modification in or disapprove 
research that qualifies for the 
exemptions proposed in the NPRM. 

The NPRM also proposed to eliminate 
continuing review for many minimal 
risk studies (namely those that qualify 
for expedited review), unless the 
reviewer documents why continuing 
review should take place, which would 
be required according to the NPRM. 
Moreover, for studies initially reviewed 
by a convened IRB, continuing review 


37 Office for Human Research Protections. 
Categories of Research That May Be Reviewed by 
the Institutional Review Board (IRB) through an 
Expedited Review Procedure. November 9, 1998. 
Retrieved from http://www.hhs.gov/ohrp/policy/ 
expedited98.html. 


would not be required, unless 
specifically mandated by the IRB, after 
the study reaches the stage where it 
involves only one or both of the 
following: (1) Analyzing data (even if it 
is identifiable private information); or 
(2) accessing follow-up clinical data 
from procedures that subjects would 
undergo as part of standard care for 
their medical condition or disease. 

In addition, the NPRM proposed that 
continuing review would not be 
required for research involving certain 
secondary research using information 
and biospecimens that requires limited 
IRB review in order to qualify for an 
exemption proposed in the NPRM. 

Further, the NPRM proposed that an 
IRB must receive annual confirmation 
that research is ongoing and that no 
changes have been made that would 
require the IRB to conduct continuing 
review (that is, the study still qualifies 
for expedited review because it still 
meets the criteria listed above and still 
involves no greater than minimal risk). 

The NPRM also proposed a new 
requirement for IRBs to maintain 
records of continuing reviews. Because 
the NPRM proposed a new provision 
that eliminates the need for continuing 
review under specific circumstances, it 
also proposed that IRBs need to justify 
the need for continuing review in cases 
where it was not required. If an IRB 
chooses to conduct continuing review 
even when these conditions are met, the 
NPRM stated that the rationale for doing 
so must be documented. 


C. Public Comments 


Approximately four comments 
addressed the clarification proposed in 
the NPRM that IRBs were not authorized 
by this policy to review exempt 
research. All who commented opposed 
the proposed modification. Those who 
commented were concerned that IRBs 
and institutions would interpret the 
modifications to mean that IRBs were 
precluded from ever reviewing such 
research and pointed to the possibility, 
although rare, that there might be a need 
to do so, particularly if the initial 
exemption determination was flawed. 

With regard to continuing review, 
approximately 120 comments discussed 
this proposal. A strong majority of 
comments (approximately 95) supported 
this proposal and approximately 15 
opposed it. Other comments were 
mixed. Those who supported the 
proposal said that it would indeed 
alleviate IRB administrative burden 
without diminishing the protections 
afforded to human subjects. Those who 
did not support this proposal believed 
the continuing review process served an 
important role in allowing an institution 


to periodically re-evaluate the benefits, 
risks, methods, and procedures used in 
research activities, and whether the 
research had been modified without 
approval. Some commenters who 
supported the proposal were opposed to 
the requirement for annual confirmation 
to the IRB that such research is ongoing 
and that no changes have been made 
that would require the IRB to conduct 
continuing review. They stated that the 
burden alleviated by eliminating the 
need for continuing review was offset by 
the requirement to submit an annual 
confirmation. 


D. Response to Comments and 
Explanation of the Final Rule: Review of 
Research 


The final rule at § .109(a) 
modifies the language of the pre-2018 
rule to state that IRBs review and have 
the authority to approve, require 
modifications in, or disapprove all 
research activities covered by this 
policy, including exempt research 
activities under § _.104 for which 
limited IRB review is a condition of 
exemption (§ .104(d)(2)(iii), 
§__.104(d)(3)@)(C), §___—--104(d)(7), 
and § _.104(d)(8)). Since the final 
rule requires limited IRB review for 
certain categories of exempt research, 
the provision at§ _.109(a) has been 
modified to clarify that IRBs have the 
authority needed to conduct limited IRB 
review. 

As proposed in the NPRM, and as 
generally supported in public 
comments, continuing review is 
eliminated for all studies that undergo 
expedited review, unless the reviewer 
explicitly justifies why continuing 
review would enhance protection of 
research subjects (§__—_—«.109(f)(1)(i) and 
§ _.115(a)(3)). For studies initially 
reviewed by a convened IRB, once 
certain specified procedures are all that 
remain for the study, continuing review 
would not be required, unless 
specifically mandated by the IRB. These 
activities include: (1) Research eligible 
for expedited review in accordance with 
§ _.110; or (2) Research that has 
progressed to the point that it involves 
only one or both of the following, which 
are part of the IRB-approved study: (a) 
Data analysis, including analysis of 
identifiable private information or 
identifiable biospecimens, or (b) 
Accessing follow-up clinical data from 
procedures that subjects would undergo 
as part of clinical care (at§ __—.109(f)). 
In addition, the final rule states at 
§ _.109(f)(1)(ii) that continuing 
review is not required for research 
reviewed in accordance with the limited 
IRB review procedure described in 
§ _.104(d)(2) (iii), 
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§___.104(d)(3)(i)(C), §__-.104(d) (7), 
or§ _.104(d)(8). 

The final rule does not require 
investigators to provide annual 
confirmation to the IRB that such 
research is ongoing and that no changes 
have been made that would require the 
IRB to conduct continuing review. 
Institutions that choose to require some 
accounting of ongoing research not 
subject to continuing review have 
significant flexibility in how they 
implement their own requirements. 
Note that under the final rule, 
investigators would still have the 
current obligations to report various 
developments (such as unanticipated 
problems or proposed changes to the 
study) to the IRB. 


X. Expedited Review Procedures 
(§ .110) 


A. Background and Pre-2018 
Requirements 


Under the pre-2018 rule, a research 
study could receive expedited review if 
the research activities to be conducted 
appear on the list of activities published 
by the Secretary of HHS that are eligible 
for such review,?8 and was found by the 
reviewer(s) to involve no more than 
minimal risk. Under an expedited 
review procedure, the review could be 
carried out by the IRB chairperson or by 
one or more experienced reviewers 
designated by the chairperson from 
among the members of the IRB. 
Research that was eligible for expedited 
review required continuing review at 
least annually. 


B. NPRM Proposals 


The NPRM proposed changes 
regarding expedited review, to allow 
expedited review to occur for studies on 
the Secretary’s list unless the 
reviewer(s) determine(s) that the study 
involves more than minimal risk. This 
was in contrast to the pre-2018 
regulations, which required that an IRB 
use the expedited review procedure 
only if the reviewer determines (and 
documents) that the research involves 
no more than minimal risk. In addition, 
OHRP has indicated that the activities 
on the current list should not be deemed 
to be of minimal risk simply because 
they are included on the list. In a related 
change, the NPRM contained a 
requirement that IRBs document the 
rationale for an expedited reviewer’s 
determination that research appearing 
on the expedited review list is more 


38 HHS. OHRP. Categories of Research That May 
Be Reviewed by the Institutional Review Board 
(IRB) through an Expedited Review Procedure. 
November 9, 1998. Retrieved from http:// 
www.hhs.gov/ohrp/policy/expedited98.html. 


than minimal risk (i.e., an override of 
the presumption that studies on the 
Secretary’s list are minimal risk). 

The NPRM proposed that IRBs 
reviewing the consent process (and, 
when required, the privacy safeguards) 
for studies eligible for the proposed 
exemption at § _.104(f)(1) could use 
the expedited review procedure. 

As discussed in Section III of this 
preamble, the NPRM did not propose to 
modify the definition of minimal risk, 
but rather proposed adding to the 
definition a requirement that the 
Secretary of HHS create and publish a 
list of activities that qualify as “minimal 
risk”. This Secretary’s list would be re- 
evaluated periodically, but at least every 
8 years, based on recommendations 
from federal departments and agencies 
and the public. Note that this would not 
be an exhaustive list of all activities that 
would be considered minimal risk 
under the Common Rule, but would 
allow IRBs to rely on the determination 
of minimal risk for activities appearing 
on the list. IRBs would still need to 
make minimal risk determinations about 
activities that do not appear on this list. 

In addition, the NPRM proposed to 
eliminate the parenthetical phrase “‘of 
one year or less” when referring to the 
IRB approval period, since annual 
continuing review of research eligible 
for expedited review would no longer be 
required. 

The NPRM also proposed that the 
regulations be revised to require 
evaluation of the list of expedited 
review categories every 8 years, 
followed by publication in the Federal 
Register and solicitation of public 
comment. A revised list would be 
prepared for public comment outside 
the scope of the NPRM. 


C. Public Comments 


Approximately 50 comments were 
received regarding the proposal to 
update the Secretary’s list of expedited 
review categories every 8 years. A strong 
majority supported this proposal 
although some recommended that the 
mandatory period of review occur more 
frequently than every 8 years. 

Approximately 10 comments 
discussed the NPRM proposal that an 
IRB may use the expedited review 
procedure to satisfy limited IRB review 
of the consent process as required under 
the proposed NPRM exemption. A 
strong majority of these comments 
supported this proposal. 


D. Response to Comments and 
Explanation of the Final Rule: 
Expedited Review Procedures 


Under the final rule, a study is 
deemed to be minimal risk and thus 


eligible for expedited review if the study 
only involves activities on the 
Secretary’s list, unless the reviewer 
determines and documents that the 
study involves more than minimal risk 
(§__.110(a) and (b)(1)). Thus, we 
anticipate that more studies that involve 
no more than minimal risk will undergo 
expedited review, rather than full 
review, which will relieve burden on 
IRBs. 

Further, IRBs will be required to 
document their rationale when they 
override the presumption that studies 
on the Secretary’s expedited review list 
involve greater than minimal risk (at 
§ _.115(a)(8)). Although public 
comments argued that this 
documentation represented an 
unjustified burden on IRBs, we believe 
that such documentation could provide 
a basis for the Secretary’s future 
determinations about the 
appropriateness of the list, and allow for 
greater consistency across institutions, 
and thus make the Common Rule more 
just. 

At§ _.110(b)(1)(iii) the final rule 
adopts the NPRM proposal that an IRB 
may use the expedited review process 
when conducting limited IRB review as 
required by the exemptions at 
§ _.104(d)(2)(iii), 
§__.104(d)(3)@)(C), §__—-104(d)(7), 
and§ _.104(d)(8). 

Finally, as proposed in the NRPM, 
evaluation of the list of expedited 
review categories will occur every 8 
years, followed by publication in the 
Federal Register and solicitation of 
public comment. 


XI. Criteria for IRB Approval of 
Research (§ .111) 


A. Background and the Pre-2018 
Requirements 


The determinations that an IRB must 
make before it can approve a study were 
spelled out in the pre-2018 rule at 
§ .111. These relate, among other 
things, to minimizing risks to subjects, 
determining that an appropriate 
relationship exists between risks and 
benefits, and ensuring the equitable 
selection of subjects. The regulations 
generally required all of these 
determinations to be made for any study 
that must undergo IRB review. 


B. NPRM Proposals 


The NPRM proposed a number of 
changes regarding the criteria for IRB 
approval of research, including (1) 
creating a new form of IRB review for 
activities relating to storing or 
maintaining data and biospecimens for 
later secondary use; (2) revising two of 
the existing criteria for approval of 
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research that have special 
considerations related to the 
involvement of vulnerable populations 
and for privacy and confidentiality of 
data provisions; and (3) adding a 
provision about plans to review the 
return of individual results to 
participants. 

The first set of changes concerned 
updating the IRB review criteria for 
research activities relating to storing or 
maintaining information and 
biospecimens, and to the secondary use 
of such information and biospecimens. 
Paragraph (a)(9)(i) of proposed 
§ _.111 would have applied to a 
proposed exemption at § _.104(f)(1) 
for storing or maintaining biospecimens 
or identifiable private information for 
use in secondary research. This 
provision would have eliminated the 
need for an IRB to make the usual 
determinations about such an activity. 
Instead, the IRB would have been 
required to determine that the 
procedures for obtaining broad consent 
to storing or maintaining the 
biospecimens or information were 
appropriate, and met the standards 
included in the introductory paragraph 
of §_.116. In addition, if these 
storage and maintenance activities 
involved a change for research purposes 
from the way the biospecimens or 
information had been stored or 
maintained, then the IRB would have 
needed to determine that the proposed 
biospecimen and privacy safeguards at 
§ .105 were satisfied for the creation 
of any related storage database or 
repository. 

The second proposed change was 
related to the NPRM privacy safeguard 
proposal and clarified that it would not 
be an IRB responsibility to review the 
security plans for biospecimens and 
identifiable private information for 
every protocol (i.e., on a case-by-case 
basis). Also, as discussed in Section VII, 
the NPRM proposed changing how 
vulnerable populations are referred to in 
the regulatory language at 
§ __.111(a)(3). 

The third proposed change was the 
addition of section (a)(8) to§ «111 
clarifying that if an investigator submits 
as part of the protocol a plan for 
returning clinically relevant research 
results to subjects, the IRB would have 
to evaluate the appropriateness of the 
plan. This criterion was proposed in 
response to public discussions, 
including SACHRP, recommending that 
IRBs consider returning individual 
results to subjects.39 





39 http://www.hhs.gov/ohrp/sachrp-committee/ 
recommendations/attachment-b-return-individual- 
research-results/index.html. 


C. Public Comments 


Approximately 20 comments 
discussed the proposed modifications in 
§ _.111 related to the criteria for IRB 
approval of research. Of these 
comments, a majority discussed the 
proposal that an IRB be required to 
review the adequacy of plans to return 
research results, should a proposed 
study include such a plan. Comments 
on this proposal were mixed, with both 
those opposing and supporting the 
proposal indicating that HHS and other 
Common Rule departments and 
agencies would need to issue detailed 
guidance addressing what is considered 
an adequate plan in this context. Several 
commenters suggested deleting this 
provision due to the lack of clarity 
surrounding the IRB’s role in such a 
review. 


D. Response to Comments and 
Explanation of the Final Rule: Criteria 
for IRB Approval of Research 


The final rule does not adopt all of the 
NPRM proposals. It does not include the 
NPRM proposal regarding IRB review of 
plans to review the return of clinically 
relevant results to subjects. This 
proposal was deleted due to concern 
over the criteria that would be required 
for an IRB to appropriately consider this 
area, the need for particular IRB 
expertise to appropriately assess the 
return of results, and ambiguity over the 
meaning of “clinically relevant.” 

The final rule does, however, revise 
two of the existing criteria for approval 
of research: (1) Special considerations 
related to the involvement of vulnerable 
populations, and (2) privacy and 
confidentiality of data provisions. 

As discussed in more detail in Section 
VII, the language regarding vulnerable 
populations at§ —_.111(a)(3) and (b) 
has been revised to reflect the current 
understanding of which populations 
should receive special consideration 
due to potential vulnerabilities specific 
to the purposes and context of human 
subjects studies and to parallel other 
references to vulnerable populations 
found at§ _.107(a). 

Section .111(a)(7) in the final rule 
retains the pre-2018 language, but also 
adds an additional requirement, thereby 
serving a dual function as both the 
primary regulatory provision requiring 
IRB review of the adequacy of 
protections for the privacy of subjects 
and confidentiality of identifiable 
private information (including that 
obtained from the analysis of 
biospecimens), and as the primary 
limited IRB review requirement needed 
to satisfy certain exemption 
determinationsin§ _.104(d). 





In§ _.111(a)(7)(i) the Secretary of 
HHS commits to issuing guidance to 
assist IRBs in assessing what provisions 
are adequate to protect the privacy of 
subjects and to maintain the 
confidentiality of information, after 
consultation with OMB’s privacy office 
and other federal departments and 
agencies that have adopted this policy. 
This modification is intended to serve a 
similar function as the privacy 
safeguards proposed in the NPRM (but 
not adopted in the final rule). The 
guidance might address the following 
considerations such as: 

e The extent to which identifiable 
private information is or has been de- 
identified and the risk that such de- 
identified information can be re- 
identified; 

e The use of the information; 

e The extent to which the information 
will be shared or transferred to a third 
party or otherwise disclosed or released; 

e The likely retention period or life of 
the information; 

e The security controls that are in 
place to protect the confidentiality and 
integrity of the information; and 

e The potential risk of harm to 
individuals should the information be 
lost, stolen, compromised, or otherwise 
used in a way contrary to the contours 
of the research under the exemption. 


The final rule at § .111(a)(8) 
modifies the NPRM proposal on the 
limited IRB review required by 
§ _.104(d)(7). Section _—.111(a)(8) 
specifies that for the purposes of 
conducting the limited IRB review 
required by § _.104(d)(7), the IRB 
must determine that broad consent for 
storage, maintenance, and secondary 
research use of identifiable 
biospecimens or identifiable private 
information is obtained in accordance 
with the requirements of 
§ _.116(a)(1)-(4), (a)(6), and (d). As 
part of its review of these requirements 
for broad consent, the IRB would review 
the appropriateness of the process 
proposed for obtaining broad consent, 
and ensure that the required elements of 
broad consent were appropriately 
included in the broad consent form (or 
process, if broad consent is to be 
obtained orally). Additionally, the IRB 
must determine that consent is 
appropriately documented, or that a 
waiver of documentation is appropriate, 
in accordance with §__.117. Finally, 
if a change is made for research 
purposes in the way identifiable private 
information or identifiable 
biospecimens are stored or maintained, 
the IRB must determine that adequate 
provisions are in place to protect the 
privacy of subjects and to maintain the 





7208 


Federal Register/Vol. 82, No. 12/Thursday, January 19, 2017/Rules and Regulations 








confidentiality of data. It is expected 
that the guidance to be developed by the 
Secretary of HHS about protecting the 
privacy of subjects and maintaining the 
confidentiality of data will also be 
applicable to the privacy and 
confidentiality considerations included 
in this limited IRB review requirement. 


XII. Cooperative Research (§ .114) 


A. Background and Pre-2018 
Requirements 


The pre-2018 rule required that each 
institution engaged in a cooperative 
research study obtain IRB approval of 
the study, although it did not require 
that a separate local IRB at each 
institution conduct such review. In 
many cases, however, a local IRB for 
each institution would independently 
review the research protocol, and 
informed consent forms and other 
materials, often resulting in multiple 
reviews for one study. When any one of 
these IRBs would require changes to the 
research protocol that are adopted for 
the entire study, investigators would 
have to re-submit the revised protocol to 
all of the reviewing IRBs. This process 
could take many months and 
significantly delay the initiation of 
research projects and recruitment of 
subjects into studies. More importantly, 
little evidence has suggested that the 
time and effort put into these activities 
by investigators (in providing materials 
to IRBs) and IRBs have significantly 
increased the well-being of research 
subjects. 


B. NPRM Proposals 


Taking into consideration the history 
of public debate on this topic and 
various sources of public comments, the 
NPRM proposed a requirement 
mandating that all institutions located 
in the United States engaged in 
cooperative research rely on a single IRB 
as their reviewing IRB for that study. 
Under this proposal, this requirement 
would not apply to: (1) Cooperative 
research for which more than single IRB 
review is required by law; or (2) 
research for which the federal 
department or agency supporting or 
conducting the research determines and 
documents that the use of a single IRB 
is not appropriate for the particular 
study. Public comment was sought on 
whether it would be useful for this 
requirement to include criteria that 
federal departments or agencies would 
need to apply in determining whether to 
make exceptions to the use of a single 
IRB requirement and what those criteria 
might be. Further the public was asked 
whether the exceptions proposed were 
appropriate and sufficient, or whether 


this mandate should have additional 
exceptions for single IRB review than 
those proposed in the NPRM. 


The change proposed by the NPRM 
would apply only to U.S.-conducted 
portions of studies because the 
flexibility to make use of local IRB 
reviews at international sites should be 
maintained. It might be difficult for an 
IRB in the United States to adequately 
evaluate local conditions in a foreign 
country that could play an important 
role in the ethical evaluation of the 
study. 


This policy would apply regardless of 
whether the study underwent convened 
review or expedited review. Under the 
NPRM, the IRB of record would be 
expected to be selected either by the 
funding agency or, if there is no funding 
agency, by the lead institution 
conducting the study. An agency may, 
but is not required, to solicit input 
regarding which IRB would be most 
appropriate to designate as the IRB of 
record. Public comment was sought on 
how this would work in practice. 


This policy would not relieve any site 
of its other obligations under the 
regulations to protect human subjects. 
Nor would it prohibit institutions from 
choosing, for their own purposes, to 
conduct additional IRB or other 
administrative reviews, though such 
reviews would no longer have any 
regulatory status in terms of compliance 
with the Common Rule. 


Some concerns about a mandated 
single IRB review for cooperative 
research point to implementation 
logistics, and the time necessary to 
establish new policies, procedures, and 
agreements. Recognizing this concern, 
the proposed compliance date was 3 
years from the publication of the final 
rule. Public comment was sought on 
whether this was a realistic timeframe. 


The public was asked to comment on 
whether mandated single IRB review for 
all cooperative research was a realistic 
option, and what the likely costs and 
benefits to institutions might be. 
Further, the public was asked to 
comment on whether additional 
resources would be necessary to meet 
this requirement in the short term and 
whether savings might be anticipated in 
the long run. Finally, public comment 
was sought regarding in what areas 
guidance would be needed for 
institutions to comply with this 
requirement and whether the Common 
Rule departments and agencies could 
take actions to address concerns about 
institutional liability, such as 
developing model written agreements. 


C. Public Comments 


This proposal was one of the most 
commented on in the NPRM, receiving 
more than 300 comments. Public 
comment was divided on whether a 
final rule should implement the 
proposal to mandate one IRB of record 
in domestic cooperative research 
studies. Of those who commented on 
this proposal, approximately 130 
supported the proposal, and 
approximately 140 opposed it. Others 
had mixed views. 

Research institutions tended to 
oppose this proposal, while individuals 
(i.e., those who were not providing 
comment in an official institutional 
capacity) and scientific organizations 
tended to support the proposal. A strong 
majority of those who opposed the 
proposal indicated that the final rule 
should encourage, rather than mandate, 
a single IRB of record in cooperative 
research studies. Arguments against the 
proposal cited the need for local review 
and potential loss of accountability, as 
well as operational issues such as the 
increased administrative capacity and 
technological systems required for a site 
to function effectively as a single IRB. 
One comment stated that mandated 
single IRB review would not eliminate 
the challenges associated with multi- 
institutional trials. The commenter 
argued that it would shift the burden 
from sponsors to investigators and at the 
institutional level, centralized systems 
would have to be developed and 
sustained in order to manage single IRB 
reviews. 

Some who supported the proposal 
stated that it would decrease 
administrative burdens and 
inefficiencies for investigators and 
institutions. Conversely, some 
commenters stated that the proposal 
should not be implemented because it 
would ultimately increase burdens and 
inefficiencies for investigators and 
institutions. 

In addition to the broad themes for 
and against this proposal, some 
commenters such as SACHRP noted that 
the proposed requirement seems 
premature at this time and suggested 
that more data are needed before such 
a provision could be implemented. 
Others said the scope of the proposal 
seemed overly broad. Many cited the 
alternative, narrower approach 
discussed in SACHRP’s public comment 
as a reasonable option.*° Further 
commenters stated that the lead 
institution likely would experience 


40 SACHRP’s public comment to the NPRM is 
available here: https://www.hhs.gov/ohrp/sachrp- 
comumnittee/recommendations/2016-january-5- 
recommendation-nprm-attachment-a/index.html. 
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increased costs if this proposal were 
implemented because of the obligations 
it would have to assume. In addition, 
some commenters said that the proposal 
does not address risk of liability to 
institutions and IRBs that are not 
considered the lead. 

Commenters also noted that long 
review times for prospective research 
studies are not solely related to the IRB 
review and approval itself. Rather, 
commenters noted that long review 
times are caused by the sum total of the 
many different types of reviews either 
mandated by other regulations or by 
institutional policy (e.g., radiation safety 
board review, privacy board review, 
departmental scientific review) that 
must be completed. These other reviews 
would likely not be affected by the 
NPRM proposal. 

Several commenters expressed 
concern that according to the NPRM 
proposal, the supporting federal 
department or agency would select the 
IRB of record as required by the 
provision. These commenters were 
concerned that the provisions did not 
seem to allow for grantee or awardee 
input on what IRB should be the IRB of 
record nor did they seem to suggest that 
funding departments or agencies should 
consult with the institutions receiving 
funding about the IRB of record. Several 
public comments also expressed 
concern about the burden this provision 
would place on nonfederally supported 
studies subject to the rule solely based 
on the clinical trials expansion 
proposed in the NPRM. 

Representatives of AI/AN tribes also 
provided comments emphasizing the 
sovereign status of their governments, 
and stating that nonlocal review would 
be inappropriate for their communities. 


D. Response to Public Comments and 
Explanation of the Final Rule: 
Cooperative Research 


The final rule adopts the NPRM 
proposal with modifications that are 
responsive to public comment. We agree 
with commenters who speculated that 
mandated single IRB review would 
ultimately decrease administrative 
burdens and inefficiencies for 
investigators and institutions, while 
acknowledging that the transition to this 
model would require significant time 
and an adjustment to institutional 
structures and policies. We concur that, 
rather than offering additional 
protections, in many cases multiple IRB 
approvals increase burden and 
frequently delay the implementation of 
studies, increasing the costs of clinical 
trials and potentially stalling access to 
new therapies. We note comments that 
expressed frustration with the frequent 


occurrence of central IRB participating 
sites insisting on separate institutional 
reviews. One comment noted that these 
additional IRB reviews generally reach 
the same conclusions, or conclusions 
with minor changes, that are then 
imposed solely on that site. When 
working optimally, we expect the 
central IRB model will work more 
efficiently and require less personnel 
time and fewer resources for tracking 
and implementing IRB changes and 
approvals, thereby eliminating the 
potential for unnecessarily duplicative 
reviews. 

Although a large number of comments 
believed that single IRB review should 
be encouraged rather than mandated, we 
feel that this incentivized approach 
would ultimately fail to yield 
substantive positive change in the 
system. Rather, systematic efficiencies 
have the best chance of occurring if 
single IRB review is required for all 
review in domestic research involving 
more than one institution. We 
acknowledge that further guidance for 
this requirement will need to be 
developed and that initial cost 
projections may have been low. 
However, we feel this change supports 
the best interests of the research 
infrastructure through increasing 
efficiency. Note that the final rule 
permits appropriate flexibilities that 
will assist in implementation. 
Institutions may still choose to conduct 
additional internal IRB reviews for their 
own purposes, though such reviews 
would no longer have any regulatory 
status in terms of compliance with the 
Common Rule. 

We agree with comments 
recommending that a greater role should 
be provided for grantee input on 
choosing the IRB of record, and have 
modified the language accordingly. The 
language at§ —_—«.114(b)(1) now states 
that the reviewing IRB (i.e., the IRB of 
record) will be identified by the federal 
department or agency supporting or 
conducting the research, yet allows lead 
institutions to propose the reviewing 
IRB, subject to the acceptance of the 
federal department or agency supporting 
the research. This provision is 
consistent with the NIH single IRB 
policy, which was published on June 
21, 2016. 

This final rule adopts (in 
§ __.114(b)(2)(i)) the NPRM’s proposal 
that cooperative research for which 
more than single IRB review is required 
by law is not subject to the requirements 
of § .114. The rule also adds 
clarifying language providing that this 
provision extends to tribal laws passed 
by the official governing body of an AI/ 
AN tribe. Thus, if the official governing 





body of an AI/AN tribe passes a tribal 
law that requires more than single IRB 
review for certain cooperative research, 
the requirement for single IRB review 
does not apply to such cooperative 
research. In addition, we highlight that 
§ _.114(b)(2)(ii) allows a federal 
department or agency the flexibility to 
determine that the use of a single IRB is 
not appropriate for certain contexts, 
thereby permitting additional IRB 
review and consideration of local and 
regional variations in some 
circumstances. 

Finally, the final rule adopts the 
NPRM proposal for this provision to 
have a delayed compliance date of 3- 
years from the date the final rule is 
published in the Federal Register. This 
transition period is intended to allow 
the regulated community appropriate 
time and flexibility in adjusting to this 
new model. 


XIII. IRB Records (§ .115) 


A. Background and Pre-2018 
Requirements 


The pre-2018 rule at§ 115 
outlined requirements for IRBs in 
preparing and documenting its activities 
and for maintaining records. 


B. NPRM Proposals 


As discussed in Section IV, the NPRM 
proposed to revise the pre-2018 
requirement that an up-to-date list of the 
IRB members and their qualifications be 
included in an institution’s assurance. 
Instead, the NPRM proposed the 
requirement that an IRB or the 
institution prepare and maintain a 
current list of IRB members. 

As discussed in Section IX, the NPRM 
proposed a new requirement for IRBs to 
maintain, as part of their records of 
continuing reviews, the rationale for 
conducting continuing review of 
research that was deemed eligible for 
elimination of continuing review per 
proposed changes at § _.109(f)(1)(ii). 
Specifically, this would apply to 
research that had progressed to the 
point that it involves only one or both 
of the following, which are part of the 
IRB-approved study: (1) Conducting 
data analysis, including analysis of 
identifiable private information, or (2) 
accessing follow-up clinical data from 
procedures that subjects would undergo 
as part of standard care for their medical 
condition. 

Also, as discussed in Section IX, the 
NPRM proposed eliminating continuing 
review for many minimal risk studies 
(namely those that qualify for expedited 
review), unless the reviewer finds and 
documents why continuing review 
should take place for the study. Finally, 
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the NPRM contained a requirement that 
IRBs document the rationale for an 
expedited reviewer’s determination that 
research appearing on the expedited 
review list is more than minimal risk 
(i.e., overturning the presumption that 
studies on the Secretary’s list are 
minimal risk). 


New in the NPRM was a proposal to 
require that an IRB maintain records of 
exemption determinations. 
Additionally, the NPRM proposed that 
the use of the proposed exemption 
determination tool would satisfy the 
proposed documentation requirement. 


In addition, a new provision was 
proposed to require that the institution 
or IRB that retains IRB records should 
safeguard, if relevant, individually 
identifiable private information 
contained in those records in 
compliance with the proposed privacy 
safeguards. 


Finally, the NPRM proposed a 
modification of the pre-2018 rule 
clarifying that IRB records may be 
maintained in print or electronic form. 


C. Public Comment 


The proposed modifications to 
§ _.115 received approximately 25 
comments. A majority focused on three 
proposed revisions. The NPRM 
proposed to require that reviewers 
document why an IRB required 
continuing review when continuing 
review was not required as proposed in 
the NPRM. The majority of commenters 
opposed this requirement stating that it 
merely shifted administrative burden 
from one activity to another with no 
increase in protections. 


The NPRM also proposed to require 
that a reviewer document why a 
research activity appearing on the 
expedited review list is more than 
minimal risk, and thus should be 
subject to full IRB review. This was 
opposed by the majority of commenters 
who indicated that this proposal was an 
unjustified administrative burden. 


One commenter stated that the 
proposed documentation requirements 
would be punitive to IRBs. Several 
others suggested that this requirement 
served as a disincentive to institutions 
who wanted to implement additional 
protections than those required by the 
Common Rule. These commenters noted 
that this seemed in contrast to the 
longstanding policy articulation that the 
Common Rule served as a “‘floor’’ for 
protections and that institutions could 
require additional protections for 
research conducted at their institutions. 


D. Response to Comments and 
Explanation of the Final Rule: IRB 
Records 


A majority of the changes proposed in 
the NPRM in § .115 have been 
retained in the final rule without 
alteration. However, the final rule 
differs from the NPRM in a few ways. 
First, the NPRM included two 
provisions requiring documentation of 
continuing review activities; these have 
been merged into one provision in the 
final rule at § .115(a)(3). Second, the 
NPRM required that the IRB keep 
records of the IRB reliance agreements 
between an institution and the IRBs not 
operated by that institution that review 
said institution’s nonexempt research 
activities. Instead, the final rule 
includes language at § —_—.115(a)(9) 
that requires each institution to 
maintain adequate documentation of the 
responsibilities that each entity will 
undertake to ensure compliance with 
this policy. This provision differs from 
the NPRM proposal to correspond to the 
more flexible provision included at 
§ __.103(e), which does not require 
the creation of a written agreement 
between an institution and a reviewing 
IRB that said institution does not 
operate. 

Because the final rule does not 
include an exemption determination 
requirement, the exemption 
documentation requirement proposed in 
the NPRM is not included in the final 
rule. Additionally, because the final rule 
does not include specified privacy 
safeguards, the NPRM proposal for an 
IRB to safeguard records as required by 
the proposed privacy safeguards is not 
included. 

The final rule includes the NPRM 
proposal that IRBs document decisions 
to require continuing review or full 
board review even in circumstances 
when such review is not required 
because we believe it is important to 
document why an IRB is making a 
determination that differs from the 
regulatory baseline. This also helps to 
promote the principle of justice (as 
applied to IRB operations). Note that 
nothing in these regulations prevents an 
institution from authorizing an IRB to 
apply standards that exceed those in the 
regulations, if indeed the institution has 
chosen to do so. 

In addition, while the NPRM 
proposed to require that IRB records 
that contain identifiable private 
information be safeguarded through 
compliance with the proposed privacy 
safeguards, the final rule does not 
require such safeguards. Although no 
public comments were received on this 
provision, in deciding not to include the 








NPRM’s proposed privacy safeguard 
requirements in the final rule, we 
determined that it was unnecessary for 
the Common Rule to impose additional 
privacy requirements on IRB records as 
we are unaware of instances in which 
IRB records were breached. In addition, 
IRB records are not the regulatory 
equivalent of research records, which 
should be adequately secured or 
safeguarded against inappropriate uses 
or disclosures of identifiable private 
information. IRB records will generally 
be secured for a variety of reasons. 
These include not only protecting 
identifiable private information, but 
also, for example, protecting discrete 
information and intellectual property 
that might be included in a protocol. 
There are other means for ensuring 
institutions and IRBs protect their 
records beyond what is required by the 
Common Rule. 


XIV. General Requirements for 
Informed Consent (§ .116) 


The final rule contains several major 
revisions to the requirements for 
informed consent, specifically with 
respect to: (1) New requirements 
relating to the content, organization, and 
presentation of information included in 
the consent form and process to 
facilitate a prospective subject’s 
decision about whether to participate in 
research; (2) the basic and additional 
elements of consent; (3) the elements of 
broad consent for the storage, 
maintenance, or secondary research use 
of identifiable private information and 
identifiable biospecimens; (4) attendant 
changes in the waiver or alteration 
criteria for consent; (5) a new provision 
that allows IRBs to approve a research 
proposal for which investigators obtain 
information or biospecimens without 
individuals’ informed consent for the 
purpose of screening, recruiting, or 
determining the eligibility of 
prospective human subjects of research, 
provided certain conditions are met; 
and, (6) a new requirement to post to a 
federal Web site a copy of an IRB- 
approved version of the consent form 
that was used for enrollment purposes 
for each clinical trial conducted or 
supported by a federal department or 
agency. Each of the final rule provisions 
are discussed separately below. 


A. General Requirements for Informed 
Consent (§ .116(a)) 


1. Background and Pre-2018 
Requirements 


Under the pre-2018 rule, many 
fundamental requirements applicable to 
all informed consents were set forth in 
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an introductory (and unnumbered) 
paragraph at the beginning of § —_—.116. 

In considering changes to the general 
requirements set forthin§ —_.116(a), 
we considered arguments put forth by 
some that consent forms have evolved to 
protect institutions rather than to 
provide potential research subjects with 
the most important pieces of 
information that a person would need in 
order to make an informed decision 
about whether to enroll in a research 
study.*1 Instead of presenting the 
information in a way that is most 
helpful to prospective subjects—such as 
explaining why someone might want to 
choose not to enroll—these individuals 
argued the forms may function more as 
sales documents or as a means to protect 
against institutional liability.42 We also 
considered a growing body of literature 
that suggests informed consent forms 
have grown too lengthy and complex, 
adversely affecting their ability to 
effectively convey the information 
needed for prospective participants to 
make an informed decision about 
participating in research.43 


2. NPRM Proposals 


The NPRM proposed adding new 
language to the introductory text of 
§ _.116 to emphasize the need to first 
provide essential information that a 
reasonable person would want to know 
in order to make an informed decision 
about whether to participate in research, 
and to provide an opportunity to 
discuss that information. Furthermore, 
in recognition of complaints that 
consent forms are too often complicated 
documents primarily used to protect 
sponsors from legal liability, the NPRM 
proposed requiring that the information 
in these forms be organized and 
presented in a way that does not merely 
provide lists of isolated facts, but rather 
facilitated the prospective subject’s or 
representative’s understanding of the 
reasons why one might or might not 
want to participate in the research. 

The NPRM also proposed that an 
investigator seeking to obtain informed 
consent be required to present first the 
information required by § _.116, 
which has been recognized by the 
Common Rule departments and 
agencies as the most fundamental and 
required content of informed consent, 


41 Levine RJ. Informed consent: Some challenges 
to the universal validity of the western model. J Law 
Med Ethics 1991;19(3-4):207-213. 

42 Menikoff J., Richards E. What the Doctor Didn’t 
Say: The Hidden Truth about Medical Research. 
New York, NY: Oxford University Press; 2006:113- 
123. 

43 Beardsley E. et al. Longer Consent Forms for 
Clinical Trials Compromise Patient Understanding: 
So Why Are They Lengthening? Journal of Clinical 
Oncology. 2007 Mar 20;25(9):e13—4. 


before providing other information, if 
any, to the subject. As proposed under 
the NPRM, the main portion ofa 
consent document could include only 
the elements of informed consent that 
were required by the Common Rule, 
with any other information included in 
an appendix. This change was intended 
to lead to substantially shorter ‘‘core’’ 
sections of consent forms, with 
prospective subjects receiving the most 
important information in the body of 
these relatively short forms, instead of 
that key information being buried in 
long and overly complex documents. As 
proposed, additional information could 
be set forth in appendices to consent 
forms. 

Given the consensus that informed 
consent forms should be written in 
appropriate language, this proposal 
reinforced the need to include 
information using language 
understandable to the subject. This goal 
was consistent with Federal Plain 
Language guidelines and the Federal 
Plain Writing Act of 2010. The NPRM 
proposed that the Secretary publish 
guidance at a later time to explain how 
consent forms could be written to 
comply with this regulatory 
requirement. Public comments were 
sought on what topics should be 
addressed in future guidance on 
improving the understandability of 
informed consents. As explained in the 
NPRM, it was not envisioned that the 
revised Common Rule would require a 
formal assessment to evaluate an 
individual’s competency, but we 
acknowledged that such a practice 
might be appropriate for certain 
populations or studies. 

In addition, the NPRM proposed to 
clarify in the introductory language at 
§ _.116 that if a HIPAA authorization 
is combined with a consent form, the 
authorization elements required by 45 
CFR 164.508 (part of the HIPAA Privacy 
regulations) must be included in the 
consent document and not the 
appendices. In other words, when 
informed consent for research under the 
Common Rule is combined with a 
HIPAA authorization, the NPRM 
proposed that the authorization 
elements would be considered to 
constitute one of the required elements 
of informed consent. 


3. Public Comments 


Approximately 200 comments 
discussed the proposal to include 
information required by the Common 
Rule in the consent form and place 
other information in appendices. A 
majority of those (approximately 140) 
supported the proposal and 
approximately 35 commenters opposed 


this proposal. Those who expressed 
support for this proposal generally 
noted agreement with the NPRM’s 
rationale for the proposed revisions. 
Even those who supported the proposal 
stated that guidance would be needed 
for the proposal to be implemented and 
for the proposal to have the desired 
effect. Among those who opposed this 
proposal, all indicated support for the 
intention behind it. Reasons for 
opposing this proposal included: 

e Concern that having a ‘“‘dual 
document” system (with a primary 
consent form and appendices) would 
not actually improve subjects’ 
understanding specifically and the 
informed consent process generally. 

e Concerns that in some 
circumstances, the information that one 
might require to make an informed 
decision about research participation 
may not always be information required 
under the Common Rule when seeking 
and obtaining informed consent. 

e Concern that the proposed language 
forthe § _.116 introductory 
paragraph should not be promulgated as 
regulatory text (and would be more 
appropriate as guidance). 

e Concern that because the proposed 
language does not include specific 
standards and specific criteria, the 
provision would ultimately be 
impossible to implement and enforce. 

e Concern that the language as 
proposed would not reduce the 
complexity and length of consent forms 
because much of the information 
generally contained in an informed 
consent document is required by 
various regulatory agencies. To this end, 
several commenters noted that the 
NPRM proposed an additional four 
required elements of consent, which 
would add to the quantity of 
information that is required to be 
discussed in an informed consent 
document. 

Some comments noted that although 
they liked the general idea of the 
proposal for the introductory paragraph 
of § _.116, they felt that the proposal 
should not focus on the length of a 
consent form, but rather on clarity and 
understandability. One comment 
expressed a need for guidance on how 
to implement the proposed language in 
the introductory paragraph of § —_—.116 
and the requirement at § _.109(b) of 
the pre-2018 rule.44 The NPRM did not 


44Section __.109(b) of the pre-2018 rule states 
that an IRB shall require that information given to 
subjects as part of informed consent is in 
accordance with § __.116. The IRB may require 
that information, in addition to that specifically 
mentioned in § _.116, be given to the subjects 
when in the IRB’s judgment the information would 

Continued 
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propose changing the latter item, which 
mandated that IRBs require that 
information given to subjects as part of 
informed consent conform with the 
requirement. However, the NPRM also 
permitted IRBs to require additional 
information if it would meaningfully 
add to the protection of the rights and 
welfare of subjects. This comment was 
made in light of the NPRM’s proposal 
that information not required as an 
element of consent at§ _—.116 must be 
provided after providing the required 
elements of consent. 

The NPRM asked about what topics 
should be addressed in future guidance 
on improving the understandability of 
informed consent. Approximately 35 
commenters answered this question, a 
majority of which were universities and 
research institutions. Several 
commenters questioned whether the 
proposals in the introductory paragraph 
of § _.116 would be enforceable, and 
how Common Rule departments and 
agencies would assess and enforce 
compliance. 

Several commenters indicated that 
mandating the order in which the 
content of consent forms should be 
presented may not always facilitate 
increased understanding by potential 
subjects because the best way to 
facilitate understanding is likely to be 
study specific. In other words, the order 
of importance of issues could be 
dependent on unique aspects of a given 
study. Others noted that most 
information in consent forms is there 
because the regulations require it to be 
included. Thus, the proposal to include 
the information required by the 
regulations up front, with all other 
information included as an appendix, is 
not a requirement that will inherently 
improve consent forms. Some 
commenters suggested that more 
research was needed on the informed 
consent process before prescribing 
specific approaches. 

Many commenters asked that future 
guidance be developed to assist in 
drafting consent forms that addresses 
language level, literacy, risk 
communication, and best practices in 
use of alternative media in the informed 
consent process (e.g., interactive 
presentation on a tablet, comic strips for 
pediatric populations). In this regard, 
some comments objected to the singular 
focus on a “form” in the proposed 
language, stating that this sends the 
message that alternative and innovative 
approaches to improving the informed 
consent process would be discouraged. 
Others noted that future guidance 


meaningfully add to the protection of the rights and 
welfare of subjects. 


should include topics of interest to 
tribal groups, such as acknowledgement 
of community-level implications of 
research and clarification about the 
handling of biospecimens in a study. 
Several commenters noted that 
guidance should focus on how to foster 
understanding rather than focusing on 
mandatory length limitations on consent 
forms. However, a few comments 
endorsed a recommended page length 
maximum, citing it as perhaps the only 
way to force investigators and 
institutions to be brief and concise in 
the presentation of relevant information. 


4. Response to Comments and 
Explanation of the Final Rule: General 
Requirements for Informed Consent 


Before addressing how the general 
requirements for informed consent 
proposed in the NPRM have been 
adopted and altered in the final rule, it 
is important to note that the structure 
for this regulatory text has been altered. 
In the pre-2018 rule, the general 
requirements were included in an 
unnumbered introductory paragraph. 
The NPRM proposed the same 
approach. To emphasize the fact that 
this paragraph includes multiple 
independent and important regulatory 
requirements, and to enable 
stakeholders and Common Rule 
departments and agencies to more easily 
reference particular requirements, these 
general requirements have been 
redesignated intoanew § _.116(a). In 
addition, the general requirement for 
consent in the final rule at 
§ _.116(a)(6) removes the reference to 
oral or written consent that was in the 
pre-2018 rule. This is the provision that 
addresses the prohibition on including 
exculpatory language through which the 
subject or the legally authorized 
representative is made to waive or 
appear to waive any of the subject’s 
legal rights, or releases or appears to 
release the investigator, the sponsor, the 
institution, or its agents from liability 
for negligence. The reference to oral or 
written consent was removed from this 
provision in the final rule. In its place, 
a similar reference was included in to 
§ _.116(a) to clarify that all the 
requirements set forthin § _.116(a) 
apply to written and oral consent. 

Another change made in the final 
tule, as compared with the pre-2018 
rule and the language proposed in the 
NPRM, is that § .116(a) contains 
introductory language summarizing 
each paragraph of § _—.116 and the 
relationship between those paragraphs. 
Given that the framework for informed 
consent has been altered and 
reorganized through this regulation, this 
introductory language is intended to 





explain the overall approach set forth in 
revised § _.116, as well as the 
significance of each paragraph. This 
introductory language is also intended 
to explain the role of broad consent 
under revised § __.116. The 
introductory paragraph explains that the 
general requirements for informed 
consent are now set forth in 

§ .116(a) and that these general 
requirements apply with respect to 
informed consent obtained pursuant to 
§ .116(b), (c), and (d) (except, as 
described later, § _.116(a)(5) does not 
apply to broad consent obtained under 

§ _.116(d)). This introductory 
language also explains that the basic 
elements of informed consent (which 
were described in § _.116 (a) of the 
pre-2018 rule) are included in 

§ .116(b) of this final rule and that 
additional elements of informed consent 
that pertain only to certain studies 
(which were described in § .116(b) 
of the pre-2018 rule) are included in 

§ .116(c) of this final rule. 

In addition, this introductory 
language explains that the requirements 
for broad consent (a concept not 
specifically addressed in the pre-2018 
rule) are described in § _.116(d) of 
this final rule. As discussed below, 
broad consent under this final rule 
differs from the broad consent approach 
proposed for § —_.116(c) in the NPRM. 
The introductory language of 
§ .116(a) explains that broad 
consent may be obtained in lieu of 
informed consent obtained under 
§ _.116(b) and § —_—.116(c) (which 
describe basic elements of informed 
consent as a general matter and 
additional elements of informed consent 
that apply only to certain studies, 
respectively) for certain purposes. 
Specifically, in lieu of obtaining study- 
specific informed consent in accordance 
with § _.116(b) and (c), broad 
consent may be obtained under 
§ .116(d) for the use of identifiable 
private information or identifiable 
biospecimens collected for either 
research studies other than the proposed 
research or nonresearch purposes for: 
(1) storage and maintenance for 
secondary research use; and (2) 
secondary research. For those purposes 
(and no others), broad consent under 
§ _.116(d) may be obtained instead of 
specific consent under § _.116(b) and 
(c). 

New introductory language at 
§ _.116(a) also summarizes the 
provisions describing circumstances in 
which waiver or alteration of the 
requirements of informed consent are 
permitted. These circumstances pertain 
to research involving public benefit and 
service programs conducted by or 
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subject to the approval of state or local 
officials at § .116(e), and to research 
more generally at§ _—_—=.116(f) (see 
below). 

Another change reflected in the final 
rule is that specific requirements for 
informed consent have been included in 
subparagraphs for clarity and emphasis. 
For example, the requirement that 
information that is given to the subject 
or the legally authorized representative 
shall be in language understandable to 
such subject or representative is no 
longer included as part of a general 
introductory paragraph and is instead 
includedas§ _.116(a)(3). Except as 
noted here, these requirements remain 
the same as they were under the pre- 
2018 rule. 

The final rule adopts, almost 
verbatim, all of the proposals made in 
the NPRM to improve and clarify the 
general requirements for informed 
consent. For example, the final rule 
adopts the proposed requirement 
specifying that the information provided 
in an informed consent form must be 
presented in sufficient detail relating to 
the research, and must be organized and 
presented in a way that does not merely 
provide lists of isolated facts, but rather 
facilitates the prospective subject’s or 
legally authorized representative’s 
understanding of the reasons why one 
might or might not want to participate. 
The final rule also adopts new language 
clarifying that this requirement applies 
to the informed consent as a whole. In 
addition, the final rule adopts the 
NPRM’s proposal that prospective 
subjects or legally authorized 
representative must be provided with 
key information that is most likely to 
assist a prospective subject or legally 
authorized representative in making a 
decision about participating in research, 
and to provide an opportunity to 
discuss that information. Moreover, the 
final rule adopts an approach, 
consistent with many public comments, 
emphasizing efforts to foster 
understanding overall rather than 
imposing specific length limitations on 
the entire consent forms. 

The final rule also includes language 
slightly different from that proposed in 
the NPRM for clarity or for conformance 
with other language in the final rule. For 
example, the final rule replaces 
references to a subject’s representative 
with references to a subject’s legally 
authorized representative (a term 
defined in § .102) for clarity. 

As discussed above, a significant 
proposal in the NPRM was that in 
obtaining informed consent, 
investigators would first have to present 
the information required by § _.116, 
before presenting any other information, 








if any. In addition, the NPRM proposed 
mandating that consent forms must 
include only the required information 
under § —_.116 and that any other 
information be included in appendices. 
The final rule does not adopt a 
requirement that certain information be 
included only in appendices. This 
approach is responsive to public 
comments expressing concerns that 
such a mandate might sometimes 
undermine the informed consent 
process. The final rule adopts a slight 
variation of that approach in response to 
public comments about perceived lack 
of flexibility in the proposed language. 
Whereas the NPRM referred to the 
“body” of the consent form as opposed 
to appendices to the consent form, the 
final rule replaces those concepts with 
references to material that must be at the 
beginning of the consent form, versus 
material that can appear after that 
beginning section. The final rule does 
not limit the information that can be 
provided in the beginning of a consent 
form to onlythe § _.116 
requirements, but instead offers a more 
flexible and meaningful approach in 
response to public concerns that the 
NPRM proposal was too prescriptive. 
Moreover, the approach recognizes 
public comments that expressed 
concerns about creating a ‘“‘dual 
document” system. As such, the final 
rule does not address appendices to the 
informed consent. However, the 
NPRM ’s references to the appendices of 
the consent form have in general been 
conceptually replaced by references to 
the material in a consent form that 
follows the “beginning”’ section. 

In particular, the final rule imposes a 
new requirement (set forth in 
§ _.116(a)(5)(i)) that the informed 
consent begin with a concise and 
focused presentation of the key 
information that is most likely to assist 
a prospective subject or legally 
authorized representative in 
understanding the reasons why one 
might or might not want to participate 
in the research. This provision further 
requires that this beginning portion of 
the informed consent must be organized 
and presented in a way that facilitates 
comprehension. This requirement 
applies to all informed consents, except 
for broad consents obtained pursuant to 
§ _.116(d), which may warrant a 
different presentation. 

This new requirement included at 
§ _.116(a)(5)(i) is somewhat similar 
to the proposal advanced in the NPRM 
insofar as both emphasize the 
importance of presenting the 
information that would be most 
important to a subject (or a legally 
authorized representative) before 


presenting other information. However, 
the requirement included in 

§ _.116(a)(5)(i) is more specific, 
detailed, and flexible. First, this 
provision requires that key information 
be included in the beginning of the 
informed consent in a concise and 
focused presentation. We recognize that 
how this requirement applies will 
depend on the nature of the specific 
research study and the information 
presented in the informed consent and 
believe that this requirement strikes an 
appropriate balance between facilitating 
the comprehension of subjects of key 
issues and allowing study-specific 
flexibilities. In general, our expectation 
is that this initial presentation of the key 
pieces of information will be relatively 
short. This section of the consent could, 
in appropriate circumstances, include a 
summary of relevant pieces of 
information that are explained in greater 
detail later in the consent form. 

The requirement that key information 
be presented in a concise and focused 
way will require an assessment that is 
specific to a study and its informed 
consent. For example, for most 
complicated clinical trials involving 
cancer patients with long (e.g., 20- to 25- 
page) consent documents, our 
expectation would be that the concise 
and focused presentation referred to in 
§ _.116(a)(5)(i) would be no more 
than a few pages, and would provide the 
key pieces of information about the trial 
in such a manner that facilitates a 
person’s comprehension of why they 
might or might not want to participate 
in the research. 

In such cases, for example, we would 
not consider a 10-page description of 
elements such as potential risks, 
accompanied by lengthy and complex 
charts and graphs, to satisfy the 
“concise and focused”’ requirement of 
§ _.116(a)(5)(i). With regard to risks 
in the type of cancer trial mentioned 
above, for example, instead of needing 
to mention every reasonably foreseeable 
risk, which would be required by 
§ _.116(b)(2), this beginning section 
of the consent form should identify the 
most important risks, similar to the 
information that a doctor might deliver 
in the clinical context in telling a 
patient how sick the chemotherapy 
drugs will make them, but with a 
particular emphasis on how those risks 
are changed by participating in the 
study. 

We recognize the advantages of 
allowing institutions to design informed 
consents, consistent with 
§ _.116(a)(5)(i), that are tailored to 
particular research studies to assist 
prospective subjects in understanding 
the most fundamental aspects of the 
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informed consent. For this reason, the 
final rule does not strictly specify the 
types of information that should or 
should not be included to satisfy 

§ _.116(a)(5)(i), or the length of such 
concise and focused presentations. This 
flexibility is responsive to public 
comments recommending against a rigid 
approach to enable institutions and 
individuals to tailor informed consents 
to the circumstances of particular 
studies. A discussion of the key 
information to be included in the 
beginning section of the consent form, 
and how it will operate in practice, may 
be further clarified in future guidance. 

We also recognize that for some 
relatively simple research studies with 
limited risks or benefits, the entire 
informed consent document may be 
relatively brief and still satisfy 
§ _.116. In such circumstances, an 
institution may determine that virtually 
all of the information required by 
§ _.116 would also satisfy 
§ _.116(a)(5)(i). In such cases, the 
informed consent document could 
include the concise and focused 
presentation of §_.116(a)(5)(i) at the 
beginning of the informed consent 
document, followed by limited 
additional information required to 
satisfy § 116. 

In all circumstances (those involving 
lengthy and complex informed consents 
as well as short and relatively simple 
informed consents), if information 
included at the beginning of the 
informed consent satisfies both 
§ _.116(a)(5)(i) and the elements of 
informed consent under § _.116(b) 
and§ __.116(c) more generally, the 
information included at the beginning 
need not be repeated later in the body 
of the informed consent. Thus, with 
respect to the example provided above 
concerning a clinical trial with cancer 
patients, the most important reasonably 
foreseeable risks to subjects would be 
summarized at the beginning of the 
informed consent as part of 
§ _.116(a)(5)(i)’s concise and focused 
presentation, but that a more 
comprehensive and detailed description 
of reasonably foreseeable risks to 
subjects would be included later in the 
body of the informed consent. In 
contrast, with respect to a relatively 
simple research study with limited 
risks, we would expect that all of the 
information provided to potential 
subjects concerning such risks might 
satisfy both § _.116(a)(5)(i) (as part of 
a concise and focused presentation of 
key information) and § —_.116(b)(2) (a 
description of any reasonably 
foreseeable risks or discomforts to the 
subject). In such circumstances, the 
information provided at the beginning 





of the informed consent would not need 
to be repeated or further detailed in the 
informed consent and the entire 
informed consent could be relatively 
short. 


In general, we would expect that to 
satisfy § _.116(a)(5)(i), the beginning 
of an informed consent would include 
a concise explanation of the following: 
(1) the fact that consent is being sought 
for research and that participation is 
voluntary; (2) the purposes of the 
research, the expected duration of the 
prospective subject’s participation, and 
the procedures to be followed in the 
research; (3) the reasonably foreseeable 
risks or discomforts to the prospective 
subject; (4) the benefits to the 
prospective subject or to others that may 
reasonably be expected from the 
research; and (5) appropriate alternative 
procedures or courses of treatment, if 
any, that might be advantageous to the 
prospective subject. As a general matter, 
a brief description of these five factors 
would encompass the key information 
most likely to assist a reasonable person 
(or legally authorized representative) in 
understanding the reasons why one 
might or might not want to participate 
in research, as required by 
§ _.116(a)(5)G) and § 116 (a)(4). 
However, we recognize that this 
determination is necessarily fact- 
specific and that IRBs and institutions 
may require that somewhat different (or 
additional) information be presented at 
the beginning of an informed consent to 
satisfy § —_.116(a)(5)(i). 

The NPRM also proposed adding a 
new requirement to the general 
introductory paragraph of § 
which would provide that if an 
authorization required by 45 CFR parts 
160 and 164 (parts of the HIPAA Privacy 
Rule) is combined with a consent form, 
the authorization elements required by 
45 CFR 164.508 must be included in the 
consent form (and not the appendices). 
Because this final rule does not 
incorporate the distinction proposed in 
the NPRM between the informed 
consent and appendices, the final rule 
does not incorporate this language. 


.116, 





We are satisfied that the approach 
adopted in this final rule will enable 
regulated entities and individuals to 
pursue different and innovative 
approaches to obtaining informed 
consent, as recommended in some 
public comments, while ensuring that 
the important aspects of informed 
consent are clearly communicated to 
prospective subjects and subjects. 


B. Basic Elements of Informed Consent 


(§___.116(b)) 


1. Background and Pre-2018 
Requirements 


Under the pre-2018 rule, investigators 
were generally required to obtain the 
subjects’ informed consent to participate 
in research.4*5 The regulations required 
that the consent form include at least 
eight specific items of information, 
including: (1) an explanation of the 
purposes of the research, its duration, 
and procedures involved, and 
identification of any procedures which 
are experimental; (2) a description of the 
reasonably foreseeable risks; (3) a 
description of any potential benefits; (4) 
a disclosure of appropriate alternative 
procedures or courses of treatment, as 
relevant; (5) information about 
confidentiality of records, 
compensation, and treatments if injury 
occurs; (6) for research involving more 
than minimal risk, an explanation as to 
whether any compensation or medical 
treatments are available if injury occurs; 
(7) contact information; and (8) a 
statement that participation is 
voluntary, and that refusal to participate 
or decision to withdraw will involve no 
penalty or loss of benefits to which the 
subject is otherwise entitled. 


2. NPRM Proposals 


In the NPRM it was proposed that 
research with nonidentified data 
continue to be considered not to involve 
“human subjects.” However, to better 
ensure that subjects are informed of the 
possibility that identifiers collected as 
part of a research study could be 
removed from the data and then be used 
for secondary research studies without 
the protections provided by this policy, 
it was proposed that a new element of 
informed consent be required. The new 
basic element of consent proposed in 
the NPRM at §__.116(a)(9) would 
apply to all research collecting 
identifiable private information. Based 
on the investigator’s plans, the informed 
consent form and process would need to 
inform subjects either that: (1) 


45 For general requirements for informed consent 
see § .116 in the pre-2018 Rule, and 21 CFR 
50.20, .25 in FDA’s comparable requirements. There 
are provisions under the Common Rule, that allow 
or the waiver of some or all of the elements of 
informed consent (see § _.116(e) and (f)). The 
Federal Food, Drug, and Cosmetic Act limits the 
circumstances under which informed consent can 
be waived. See, e.g., section 520(g) (21 U.S.C. 
360j(g)). Currently, FDA regulations contain only 
two exceptions from informed consent in certain 
ife-threatening and emergency situations under 21 
CFR 50.23-24. However, the 21st Century Cures Act 
recently amended the Federal Food, Drug and 
Cosmetic Act to allow waiver of informed consent 
or certain FDA-regulated minimal risk 
investigations. 
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identifiers might be removed from the 
data and that the nonidentified data 
could be used for future research studies 
or distributed to another investigator for 
future research studies without 
additional informed consent from the 
subject or the representative, if this 
might be a possibility; or (2) the 
subject’s data collected as part of the 
research, from which identifiers are 
removed, would not be used or 
distributed for future research studies. 


3. Public Comments 


Approximately 40 public comments 
were received on the proposed new 
required element of informed consent 
found in the NPRM at proposed 
§ _.116(a)(9). A large majority 
favored this proposal. Those who 
supported this proposal indicated that it 
provided useful information to 
prospective subjects about how private 
information obtained from a study 
might be used in the future. They also 
commented that it enhanced 
transparency in research, providing 
potential subjects with the information 
they need to decide whether to 
participate. Those who opposed this 
proposal suggested that it would 
increase the length of consent forms 
without appreciably improving 
potential subjects’ understanding ofa 
specific research activity. 


4. Response to Comments and 
Explanation of the Final Rule: Basic 
Elements of Informed Consent 


The final rule, at§ —_—.116(b)(9), 
adopts the NPRM proposal to inform 
potential subjects about the possible use 
of their identifiable private information 
with two clarifying changes. First, 
because the final rule at § —_—.102(e)(1) 
now states that the definition of human 
subject, in part, includes research in 
which an investigator obtains, uses, 
studies, analyzes, or generates 
identifiable biospecimens or identifiable 
private information, this new element of 
informed consent has been clarified to 
specifically apply to any research that 
involves the collection of identifiable 
biospecimens, rather than all 
biospecimens, in addition to research 
that involves the collection of 
identifiable private information. In 
addition, a change to what was 
proposed in the NPRM has been made 
to the new element of consent in the 
final rule at§ —_—.116(b)(9) (ii), to 
clarify that it is intended to inform 
subjects that their information or 
biospecimens collected as part of the 
research will not be used or distributed 
for future research, even if identifiers 
are removed. 


We agree with the public comments 
that indicated this new element of 
consent will provide useful information 
to prospective subjects about whether 
their identifiable private information or 
identifiable biospecimens might be 
stripped of identifiers and used for 
future research studies or distributed to 
another investigator for future research 
studies without additional informed 
consent from the subject or the legally 
authorized representative. 

We expect that this information can 
usually be provided in a brief statement, 
and disagree with the commenters that 
suggested that this new basic element of 
consent would increase the length of 
consent forms without appreciably 
improving potential subjects’ 
understanding of a specific research 
activity. This new requirement is 
intended to give the potential subject a 
right to know that identifiers might be 
removed from information or 
biospecimens and be used for future 
research without additional consent, 
when such a possibility exists, so he or 
she can make a fully informed decision 
about whether to participate in the 
research. If subjects’ identifiable private 
information or identifiable 
biospecimens will not be used for future 
research studies, even if identifiers are 
removed, this new element of consent 
requires that subjects be informed of 
this as well. Finally, if a specific 
technology or technique determined to 
be capable of generating identifiable 
private information or identifiable 
biospecimens through the consultative 
process described at§ _.102(e)(7) 
will be used, that information should be 
included in the description of the 
research at§ _.116(b)(1). 


C. Additional Elements of Informed 
Consent (§ .116(c)) 


1. Background and Pre-2018 
Requirements 


The pre-2018 rule contained six 
additional elements of consent required 
when appropriate: (1) A statement that 
the particular treatment or procedure 
may involve risks to the subject (or to 
the embryo or fetus, if the subject is or 
may become pregnant) which are 
currently unforeseeable; (2) anticipated 
circumstances under which the subject’s 
participation may be terminated by the 
investigator without regard to the 
subject’s consent; (3) any additional 
costs to the subject that may result from 
participation in the research; (4) the 
consequences of a subject’s decision to 
withdraw from the research and 
procedures for orderly termination of 
participation by the subject; (5) a 
statement that significant new findings 


developed during the course of the 
research which may relate to the 
subject’s willingness to continue 
participation will be provided to the 
subject; and (6) the approximate number 
of subjects involved in the study. 


2. NPRM Proposals 


The NPRM proposed adding three 
additional elements of consent that, 
when appropriate, would be required to 
be included in the informed consent 
form and process. These proposed 
additional elements of consent pertain 
to issues that have become more 
relevant in recent years as science has 
advanced and the nature of research has 
changed. One proposed new element 
would require that prospective subjects 
be informed that their biospecimens 
may be used for commercial profit and 
whether the subject will or will not 
share in this commercial profit. A 
second proposed element would require 
that prospective subjects be informed of 
whether clinically relevant research 
results, including individual research 
results, will be disclosed to subjects, 
and if so, under what conditions. A 
third proposed new element would 
provide subjects or their legally 
authorized representatives with an 
option to consent, or refuse to consent, 
to investigators re-contacting the 
research subject to obtain additional 
information or biospecimens, or for 
future research. 


3. Public Comments 


Each of the proposed additional 
elements of informed consent found in 
the NPRM at § _.116(b)(7)-(9) 
received approximately 50 comments. 
All three proposals were generally 
favored by the public. With respect to 
the proposed element of consent at 
§ _.116(b)(7), requiring that 
prospective subjects be informed that 
their biospecimens may be used for 
commercial profit and whether the 
subject will or will not share in this 
commercial profit, comments, especially 
from individual members of the public 
not identified with any institution or 
organization, indicated that the extent to 
which an investigator might profit from 
information or biospecimens collected 
or used during a study was an important 
decision point as to whether a 
prospective subject would want to 
participate in a study. In response to 
proposed element § _.116(b)(8)— 
requiring that prospective subjects be 
informed of whether clinically relevant 
research results, including individual 
research results, will be disclosed to 
subjects, and if so, under what 
conditions—several public comments 
stated that knowing whether or not 
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research results would be returned to 
them was an important piece of 
information for them to know and 
understand in deciding whether to 
participate in a study. 

Finally, comments discussing 
§ _.116(b)(9) regarding the potential 
to be contacted for future studies noted 
that allowing an individual to indicate 
whether or not he or she might be 
contacted for future research studies 
respected subject autonomy. Those who 
opposed the provision noted that while 
the intent of the provision was laudable, 
the ensuing tracking system that would 
need to be developed by institutions to 
track who had said ‘‘yes”’ or ‘‘no”’ to 
being re-contacted, and in what 
circumstances, would be difficult to 
develop and maintain, and would also 
represent significant costs to institutions 
without a corresponding tangible 
increase in the protections afforded to 
human subjects. 


4. Response to Comments and 
Explanation of the Final Rule: 
Additional Elements of Consent 


The final rule contains two of the 
three proposed additional elements of 
consent. The final rule does not include 
the additional element proposed in the 
NPRM relating to providing subjects or 
their legally authorized representatives 
the option to consent or refuse to 
consent to being re-contacted to obtain 
additional information or biospecimens, 
or for future research. 

New additional elements included in 
the final rule are: (1) A statement that 
the subject’s biospecimens (even if 
identifiers are removed) may be used for 
commercial profit and whether the 
subject will or will not share in this 
commercial profit (§ .116(c)(7)); and 
(2) a statement regarding whether 
clinically relevant research results, 
including individual research results, 
will be disclosed to subjects, and if so, 
under what conditions 
(§___.116(c)(8)). Because many public 
comments addressed a desire to share in 
the profits of successful products 
developed using their biospecimens, we 
believe that investigators, when 
appropriate, should inform prospective 
subjects about whether they might or 
might not benefit commercially from 
future products resulting from the 
research, should that possibility be 
important in their decision making 
process. Also, several comments 
received from individuals who reported 
participation in research studies 
described disappointment that research 
results were not returned to them. We 
believe that potential subjects should be 
aware of the possibility that they might 
not receive research results, as well as 





the possibility that they might, so that 
they can factor that information into 
their decision about whether to consent 
to research. This provision is intended 
to pertain to all clinically relevant 
research results, including general or 
aggregate research findings and 
individual research results. 

We are also including in the final rule 
an additional element that when 
appropriate for research involving 
biospecimens, subjects be informed of 
whether the research will (if known) or 
might include whole genome 
sequencing (WGS) (§__.116(c)(9)). 
This provision of the final rule describes 
WGS as the sequencing of a human 
germline or somatic specimen with the 
intent to generate the genome or exome 
sequence of that specimen. WGS 
generates an extremely large amount of 
information about people, including 
factors that will contribute to their 
future medical conditions. As was 
recognized in the NPRM’s Alternative 
Proposal A to expand the definition of 
“human subject” to include WGS 
(discussed in Section III), data obtained 
through WGS can provide important 
insights into the health of individuals as 
well as their biological family. It is also 
possible that WGS data gathered for one 
purpose may reveal important 
information, perhaps unanticipated and 
unplanned for, years later. Given the 
unique implications of the information 
that can be developed through WGS, if 
it is either known that a specific 
research study will include this 
technique, or might include it, we 
believe that this aspect of the research 
must be disclosed to prospective 
subjects as part of the informed consent 
process. It is recognized that under the 
pre-2018 rule, if a research study were 
to involve WGS, this research procedure 
would have almost always been 
included in the description of the 
research. However, to remove any 
ambiguity about whether such 
information would need to be included 
in the informed consent, the final rule 
makes this requirement explicit through 
this new element of consent. 

The information that would have to 
be disclosed under these additional 
elements of consent is often relevant to 
an individual’s decision of whether to 
participate in a research study. Such 
information may have been included in 
informed consent forms under the pre- 
2018 rule. However, the final rule now 
requires inclusion of these additional 
elements, when appropriate. 

The additional element of consent 
proposed in the NPRM that was not 
included in the final rule would have 
required providing subjects or their 
legally authorized representatives with 


an option to consent, or refuse to 
consent, to investigators re-contacting 
the subject to seek additional 
information or biospecimens or to 
discuss participation in another 
research study. Although for some 
research studies, it will be desirable to 
inform prospective subjects about 
investigators’ plan to re-contact subjects 
for certain purposes, and give them the 
option to agree or disagree to such re- 
contact, we agree with the public 
comments that questioned the 
importance of requiring that such 
information be included in the consent 
form. Although the final rule does not 
include this additional element of 
consent, this information can be 
included in the consent form. 


D. Elements of Broad Consent for the 
Storage, Maintenance, and Secondary 
Research Use of Identifiable Private 
Information or Identifiable 
Biospecimens (§__.116(d)) 


1. Background and Pre-2018 
Requirements 


Under the pre-2018 rule, if identifiers 
are removed from information and 
biospecimens such that the identity of 
the subject could not be readily 
ascertained by an investigator or 
associated with the information or 
biospecimens, then such information 
and biospecimens that have been 
collected for purposes other than the 
proposed research could be used 
without any requirement for informed 
consent. Similarly, under the HIPAA 
Privacy Rule, if data are de-identified or 
HIPAA identifiers do not accompany 
biospecimens, then the Privacy Rule 
does not apply. When identifiers have 
not been removed, under the pre-2018 
rule investigators were allowed in 
certain situations to obtain a consent 
that is broader than for a specific 
research study, such as for creating a 
research repository that involves 
obtaining biospecimens from living 
individuals for use in future research 
studies. In these cases, an IRB could 
determine that the original consent for 
the creation of the research repository 
satisfied the requirements of the 
Common Rule for the conduct of the 
future research, provided that the 
elements of consent continue to be 
satisfied for the future research. Despite 
this flexibility in the Common Rule, 
stakeholders and the Common Rule 
departments and agencies believe that 
the elements of consent required under 
§ .116 of the pre-2018 rule often 
were not satisfied in the case of broad 
consent for future unspecified research 
use of identifiable private information 
or identifiable biospecimens. 
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With respect to HIPAA, HHS’s pre- 
2013 interpretation of the HIPAA 
Privacy Rule was that authorizations for 
research needed to be study-specific, 
and thus, that such authorizations could 
not authorize certain future unspecified 
research. However, in January 2013, the 
Office for Civil Rights modified its prior 
interpretation.46 Under the new 
interpretation, an authorization now 
may be obtained from an individual for 
uses and disclosures of protected health 
information for future research 
purposes, so long as the authorization 
adequately describes the future research 
such that it would be reasonable for the 
individual to expect that his or her 
protected health information could be 
used or disclosed for the future research 
purposes. 

Because biospecimens and 
information that have been collected for 
clinical use or purposes other than for 
the proposed research are often an 
important source of information and 
material for investigators, and the re-use 
of existing information and materials 
can be an efficient mechanism for 
conducting research without presenting 
additional physical or psychological 
risks to the individual, it seemed 
prudent to consider changes to current 
regulations relating to those issues. 


2. NPRM Proposals 


The NPRM proposed to allow broad 
consent to cover the storage or 
maintenance for secondary research use 
of all biospecimens (regardless of 
identifiability) and identifiable private 
information. Broad consent would be 
permissible for the storage or 
maintenance for secondary research of 
such information and biospecimens that 
were originally collected for either 
research studies other than the proposed 
research or nonresearch purposes. The 
broad consent document would also 
meet the consent requirement for the 
use of such stored biospecimens and 
information for individual research 
studies. The NPRM made a separate 
case for nonidentified private 
information than it did for 
biospecimens, stating that consent 
would not be required for the secondary 
research use of nonidentified private 
information, such as the research use of 
medical records that have had all 
identifiers removed. Because the NPRM 
proposed that the definition of human 


46 HHS. Modifications to the HIPAA Privacy, 
Security, Enforcement, and Breach Notification 
Rules Under the Health Information Technology for 
Economic and Clinical Health Act and the Genetic 
Information Nondiscrimination Act; Other 
Modifications to the HIPAA Rules. 78 FR 5611 (Jan. 
25, 2013). Retrieved from https://www.gpo.gov// 
fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf. 


subject be expanded to include all 
biospecimens, it also proposed to 
facilitate research using biospecimens 
by permitting broad consent to be 
obtained for their storage or 
maintenance for secondary research. 

It was envisioned that the proposed 
broad consent provision would be used 
by institutions and investigators to give 
individuals the choice to either allow or 
disallow the use of their biospecimens 
and identifiable private information for 
secondary research. In some cases, 
institutions would be expected to seek 
broad consent as part of a research 
protocol to create a research repository 
of biospecimens or information. 
However, in other cases it was expected 
that institutions, particularly those that 
do not typically conduct human 
subjects research, might not develop a 
research protocol to create a research 
repository, but still choose to seek broad 
consent from individuals for the 
research use of their biospecimens or 
identifiable private information. In such 
cases, these institutions might simply 
“tag” biospecimens and information as 
either available or not available for 
secondary research. 

Because broad consent is a different 
form of consent than the consent that is 
obtained for a specific research study, 
the NPRM proposed required elements 
for broad consent that would include 
several of the basic and additional 
elements of informed consent, but not 
all, and would include several 
additional required elements. The 
NPRM proposed to require that the 
information included in broad consent 
describe the biospecimens and 
identifiable private information that 
would be covered by the consent, 
recognizing that the biospecimens and 
information to be used in future 
research studies might be collected after 
the consent was obtained. Further, the 
NPRM proposed that broad consent for 
the research use of biospecimens or 
identifiable private information 
obtained for nonresearch purposes 
would be limited to covering either or 
both of the following: (1) Biospecimens 
or identifiable private information that 
exist at the time at which broad consent 
is sought; and (2) biospecimens or 
identifiable private information that will 
be collected up to 10 years after broad 
consent is obtained for adult subjects, 
and, for research involving children as 
subjects, biospecimens or identifiable 
private information that will be 
collected up to 10 years after broad 
consent is obtained or until the child 
reaches the legal age of consent to the 
treatments or procedures involved in 
the research, whichever comes first. 


The NPRM proposed to include the 
standard concerning who is a child 
based upon the definition of ‘‘children” 
as defined at 45 CFR 46.402(a). At the 
time the child becomes an adult, the 
broad consent or permission would no 
longer be valid and either broad consent 
would need to be sought from the child- 
turned-adult, or the investigator would 
need to seek a waiver of informed 
consent in order to use the individual’s 
biospecimens or identifiable private 
information for research, unless one of 
the exclusions or exemptions were 
applicable. 

A proposed element of broad consent 
in the NPRM included a requirement 
that subjects be informed that they may 
withdraw consent, if feasible, for 
research use or distribution of the 
subject’s information or biospecimens at 
any time without penalty or loss of 
benefits to which the subject is 
otherwise entitled. However, 
information that has been stripped of 
identifiers might not be traceable. Thus, 
it might not be feasible to withdraw 
consent for future use or distribution in 
this case. If, however, an investigator 
committed to permitting a subject to 
discontinue the use of such information, 
it was expected that the investigator 
would honor this commitment by not 
stripping identifiers and using the 
information or biospecimens in 
research. The proposed regulations 
would not require investigators to make 
such a commitment. 

Another proposed element of broad 
consent in the NPRM related to the 
public posting of nonidentified data 
about a subject. This proposed element 
of broad consent would include an 
option, when relevant, for an adult 
subject or the subject’s legally 
authorized representative to consent or 
refuse to consent to the inclusion of the 
subject’s data with removal of the 
identifiers listed in the HIPAA Privacy 
Rule at 45 CFR 164.514(b)(2)(i)(A) 
through (Q), in a database that is 
publicly available and openly accessible 
to anyone. This provision was proposed 
in the context of increasing interest in 
inviting study participants to allow their 
study data, in some cases including 
genomic data, to be made publicly 
available in order to maximize the 
potential for research that spurs 
increased understanding of disease 
processes. Under this provision, the 
consent document would be required to 
prominently note the option for the 
participant to allow the investigator to 
publically post (e.g., on a Web site) the 
participant’s genomic or other 
potentially identifiable sensitive 
information, and to include a 
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description of the risks associated with 
public access to the data. 

To facilitate the use of broad consent, 
the NPRM proposed that the Secretary 
of HHS would publish in the Federal 
Register templates for broad consent 
that would contain all of the required 
elements of consent in these situations. 
It was envisioned that at least two broad 
consent templates would be developed: 
one for information and biospecimens 
originally collected in the research 
context, and another for information 
and biospecimens originally collected in 
the nonresearch context. 

Public comment was sought on 
whether broad consent to secondary 
research use of information and 
biospecimens collected for nonresearch 
purposes should be permissible without 
a boundary, or whether a time limitation 
or some other type of limitation should 
be imposed on information and 
biospecimens collected in the future 
that could be included in the broad 
consent as proposed in the NPRM. Ifa 
time limit should be required, public 
comment was sought on whether the 
NPRM proposal of up to 10 years was 
a reasonable limitation and whether a 
limitation related to an identified 
clinical encounter would better inform 
individuals of the clinical information 
and biospecimens that would be 
covered by a broad consent. Public 
comment was also sought on whether 
all of the elements of broad consent 
proposed in the NPRM should be 
required for the secondary use of 
biospecimens or identifiable private 
information originally collected as part 
of a research study that was conducted 
without consent because (1) either the 
original research study met an exclusion 
or exempt category of research, or (2) a 
waiver of consent was approved by an 
IRB. 

Public comment was sought on how 
likely investigators are to seek broad 
consent for the use of identifiable 
private information (as contrasted with 
biospecimens), given that provisions 
within the NPRM would make it easier 
to do such research without consent. In 
this regard, the NPRM proposal to 
prohibit waiver of consent by an IRB if 
a person has been asked for broad 
consent and refused to provide it could 
create a disincentive on the part of 
investigators from choosing to seek 
broad consent for research involving 
secondary use of identifiable private 
information. Given the costs and time 
and effort involved in implementing the 
system for obtaining broad consent for 
the use of identifiable private 
information and tracking when people 
provide consent or refuse to do so, the 
public was asked to comment on 


whether the benefits to the system were 
likely to outweigh the costs, and if so, 
whether the broad consent provisions 
should be limited to obtaining broad 
consent for research use of 
biospecimens. 


3. Public Comments 


Approximately 475 comments 
addressed broad consent, a majority of 
which expressed opposition to broad 
consent as proposed and discussed in 
the NPRM. The basis of this opposition 
was largely related to the NPRM 
proposal that some type of consent 
(broad or specific) would be required for 
research with nonidentified 
biospecimens. A smaller number of 
comments (approximately 150) 
addressed the adequacy or inadequacy 
of broad consent as a concept, or the 
proposed broad consent templates to be 
created by HHS. 

Public comment on the proposed, but 
not yet developed, broad consent 
templates was mixed, with a majority of 
comments stating that it was impossible 
to comment on a template that had not 
yet been created. Even among those who 
supported the use of broad consent, 
some had questions about whether 
broad consent provided at one 
institution would be sufficient for 
research ultimately conducted at 
another institution. Many comments 
further noted that the entire regulatory 
schema around broad consent (e.g., 
exemptions dependent on broad 
consent, prohibition on an IRB waiving 
broad consent if broad consent had been 
sought and someone declined) required 
additional study and discussion and 
recommended that the department issue 
another NPRM on these issues following 
some form of systematic analysis and 
broader public consultation. A 
professional investigative pathology 
association and many of its members 
endorsed the concept of broad consent 
and the development of templates by 
the Federal Government, writing that 
they would be less burdensome but still 
a functional way of promoting ethically 
conducted biomedical research with 
biospecimens. 

Several commenters suggested that 
institutions needed to retain the ability 
to create and amend broad consent 
forms tailored to a variety of situations 
rather than rely on a federal template. 
These comments also generally stressed 
the importance of retaining an IRB’s 
active role in reviewing the broad 
consent process and specific secondary 
research studies to ensure that interests 
other than autonomy and concerns other 
than those related to privacy were 
considered in a proposed study. A 
minority of commenters additionally 


expressed concern with the Federal 
Government’s ability to develop broad 
consent templates that the regulated 
community might feel were sufficiently 
informative. 

Public comments were also mixed on 
whether or not broad consent as 
proposed in the NPRM would constitute 
meaningful consent. Many comments 
noted that a consent form sufficiently 
broad to cover all potential future 
secondary research uses of 
biospecimens or identifiable private 
information might be so broad and 
vague as to be not meaningful or 
informative to prospective research 
subjects. Others doubted the 
meaningfulness of broad consent 
obtained in the clinical setting. One 
academic research institution 
questioned whether it was really 
consent at all, but rather an agreement 
or permission, and another commenter 
questioned whether broad consent 
would increase subjects’ autonomy. 

Many of the commenters who 
opposed broad consent also argued 
against any requirement to obtain 
consent for the use of nonidentified 
biospecimens. One academic research 
institution raised serious concerns about 
obtaining meaningful broad consent, 
which undermines existing privacy and 
other protections for subjects in 
research. Others noted that requiring 
broad consent for all secondary use of 
all biospecimens would require that 
there always be a link or code between 
the biospecimen and the subject’s 
identity, which ultimately would result 
in an overall increase in privacy risks. 
Many commenters favored an opt-out 
system for broad consent (especially 
with respect to broad consent for use of 
nonidentified biospecimens). An AI/AN 
organization expressed overall concern 
about the concept of broad consent, 
noting that many AI/AN people believe 
that specimens and blood are 
considered sacred and recommending 
that all secondary uses of collected 
specimens and data should require an 
additional consent process, including 
tribal consent when specimens and data 
are obtained from AI/AN populations. 

Few comments were received on the 
actual proposed elements of broad 
consent. Of these, a majority expressed 
confusion with the proposals related to 
the duration of the consent and the 
scope of the biospecimens and 
identifiable information that could be 
collected. 

The NPRM also asked whether broad 
consent to secondary research use of 
information and biospecimens collected 
for nonresearch purposes should be 
permissible without a boundary, or 
whether a time limitation or some other 
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type of limitation should be imposed on 
information and biospecimens collected 
in the future that could be included in 
the broad consent. If a time limit should 
be required, the NPRM asked whether 
up to 10 years was a reasonable 
limitation. It also asked whether a 
limitation related to an identified 
clinical encounter would better inform 
individuals of the clinical information 
and biospecimens that would be 
covered by a broad consent document. 
Approximately 65 commenters 
specifically answered this question. 

Most who commented were opposed 
to the 10-year limitation on the period 
of time that an institution could collect 
biospecimens and information from an 
individual once broad consent had been 
sought and obtained. They stated that 
the limitation was arbitrary, not 
supportable by anything discussed in 
the NPRM, and presented an 
administrative burden for institutions 
and investigators to time stamp and 
track the 10-year limit for each subject. 
A few commenters stated that a 10-year 
limit is a reasonable boundary, but were 
concerned about the need to re-consent 
people once they reach the legal age of 
consent. In large data sets, identifying 
such people could be very challenging 
as people often move locations during 
such lengths of time, which would 
create an administrative barrier. A few 
commenters suggested that 10-year 
boundary was too long and one research 
institution commented that in its 
experience individuals seem to prefer 
shorter time limits tied to specific 
periods (e.g., a series of clinical 
encounters, participation in an ongoing 
study). 

A few comments stated that any time 
limit could have a negative effect on 
rare disease research as the numbers of 
affected people are so small and, as 
discoveries are made, there is often a 
need to go back to years’ worth of 
information or stored biospecimens to 
search for markers, mutations, or 
clinical information that is related to the 
new discovery. Such commenters 
expressed concern that this could be 
deleterious to individuals with rare 
disease seeking a diagnosis. 

Some commenters were confused 
about how the 10-year boundary 
proposed in the NPRM was supposed to 
function. Some comments assumed that 
one could only use the biospecimens or 
data for a 10-year period and after that 
period one would be required to get 
consent again for the use of those items. 
Others assumed that investigators 
would have to re-consent people every 
10 years, but the information and 
biospecimens could be used 
indefinitely. For these reasons, many 


comments on the 10-year boundary said 
it was unreasonable and unworkable 
operationally. Some suggested that 
instead of 10-year boundary, patients 
could be routinely reminded that they 
gave consent and can be reminded that 
they can opt out at any time. Several 
large research institutions commented 
that the time limit would necessitate a 
lot of tracking for institutions and could 
lead to smaller health care institutions 
ceasing their collection of biospecimens 
for research, which would ultimately 
have a negative impact on research. 


The NPRM also asked whether all of 
the elements of consent proposed at 
§ _.116(c) should be required for the 
secondary use of biospecimens or 
identifiable private information 
originally collected as part of a research 
study that was conducted without 
consent because either the original 
research study met an exclusion or 
exempt category of research, or a waiver 
of consent was approved by an IRB. 
Approximately 30 comments answered 
this question. Responses ranged from 
those saying the elements are not as 
relevant as the burden of having to seek 
consent every 10 years. Many stated that 
the elements of consent appeared to be 
growing in the proposed rule at the 
same time that the rule was requiring 
simpler and shorter consent forms. As 
such, efforts should not be made to 
include all of the elements required in 
specific consent to broad consent; 
otherwise the intent of broad consent 
would be lost. 


The NPRM also asked whether oral 
consent should be permissible in 
limited circumstances as proposed 
under the exemption for the storage and 
maintenance of biospecimens and 
identifiable private information. More 
than 60 pathologists, pathology 
departments, and pathology 
organizations suggested that oral 
consent should not be allowed in this 
context because it raises too many 
administrative challenges and may 
undermine public trust. A few 
commenters felt oral consent should be 
permitted but generally did not provide 
a rationale. 


Finally, some comments indicated 
that broad consent as a concept should 
not be included in a final rule, and that 
the standards that exist under the pre- 
2018 rule for secondary research (i.e., 
either that an investigator obtains study 
specific consent or a waiver of informed 
consent from an IRB) should be 
maintained in a final rule. 


4. Response to Comments and 
Explanation of the Final Rule: Elements 
of Broad Consent 


The final rule includes an option to 
obtain broad consent for the storage, 
maintenance, and secondary research 
use of identifiable private information 
or identifiable biospecimens, as defined 
at § _.102(e)(5) and (6), but several 
significant changes were made in 
response to public comments. Although 
in some ways the final rule’s broad 
consent provision resembles the 
provision that was proposed in the 
NPRM, it is important to recognize a 
very fundamental difference between 
the role that this provision will play 
under the final rule, as compared to the 
role it was intended to play under the 
NPRM. This key difference relates to the 
fact that the provisions in the NPRM 
that would have generally required 
consent for secondary research use of 
nonidentified biospecimens, including 
imposing narrow stringent criteria for 
IRB waiver of consent with respect to 
such research, are not being 
implemented because the NPRM’s 
proposal that all biospecimens, 
regardless of their identifiability, be 
covered under the Common Rule has 
not been adopted. Importantly, under 
the final rule, broad consent is 
permissible only for secondary research 
and no other types of research. 

Thus, had all of those NPRM 
provisions been implemented, 
investigators who wanted to conduct 
secondary research with biospecimens 
would in most instances have found 
themselves essentially forced to use the 
new broad consent provisions as their 
only practical option for conducting 
such research. This is because generally, 
under the NPRM proposals, they would 
no longer have had the option to de- 
identify information or biospecimens, or 
to use them in coded form, to avoid 
application of the Common Rule’s 
requirements. Under the NPRM’s 
proposals, had investigators not 
obtained broad consent, they would 
often not practicably be able to meet the 
informed consent requirements relating 
to such research (which would have 
been covered under the Common Rule). 
Therefore, it would generally have been 
the case that they would have had little 
choice but to obtain broad consent, 
assuming they did not want to 
undertake the alternative of obtaining 
study-specific consent from subjects 
each and every time they conducted a 
study involving secondary use of 
biospecimens. 

Given that we did not adopt the 
NPRM’s proposal to cover all 
biospecimens regardless of their 
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identifiability under the Common Rule, 
the final rule also does not adopt 
proposed consent requirements for 
secondary research with nonidentified 
biospecimens. For this reason, the final 
rule’s provisions relating to broad 
consent now play a very different role 
from those proposed in the NPRM. In 
most instances, these provisions will be 
providing new options—that is, new 
flexibility—to an investigator, in 
addition to those options that an 
investigator would have had under the 
pre-2018 rule. An investigator wishing 
to do secondary research with 
biospecimens will continue to have the 
option of doing secondary research with 
nonidentifiable biospecimens, as was 
the case in the pre-2018 rule. An 
investigator also could continue to use 
biospecimens that are coded, thus 
allowing the collection of additional 
information about the subjects over 
time.47 In both of those instances, no 
additional consent would be required 
because the research would not involve 
human subjects as defined by the final 
rule. Furthermore, even if the 
investigator wanted to use the 
biospecimens with identifiers attached, 
he or she would still have the option of 
asking an IRB to waive the requirement 
to obtain informed consent: the waiver 
criteria are in most respects unchanged 
under the final rule. 

For these reasons, the broad consent 
provisions at § .116(d) afford 
investigators wishing to conduct 
secondary research on identifiable 
private information or identifiable 
biospecimens an additional alternative 
to obtaining an IRB waiver of consent or 
to obtaining study-specific consent. 
Given that these new broad consent 
provisions are essentially a new 
alternative to other options that are very 
similar to those that existed under the 
pre-2018 rule, these provisions are not 
increasing any regulatory burden or 
making it more difficult to do research. 
Indeed, just the opposite is the case. The 
changes made in the final rule are 
responsive to the significant criticisms 
expressed by many of the commenters 
about what the NPRM proposed, under 
which obtaining broad consent would 
have imposed substantial new burdens 
on a vast amount of secondary research 
with biospecimens. In contrast, when 
investigators choose to use the broad 
consent provisions under the final rule, 
they will presumably be doing so 
because this new option is less 





47 HHS. Office for Human Research Protections. 
Coded Private Information or Specimens Use in 
Research, Guidance. October 16, 2008. Retrieved 
from hittps://www.hhs.gov/ohrp/regulations-and- 
policy/guidance/research-involving-coded-private- 
information/index.html. 


burdensome to them than their other 
(largely unchanged) options for 
conducting such research. 

Although we recognize public 
commenters’ concern that broad consent 
might not be as meaningful or 
informative as study-specific consent, it 
is also important to note that when an 
investigator chooses to use this new 
option, doing so will generally provide 
increased protection to the autonomy of 
research subjects. It will give them a 
choice to say no to such research, in 
contrast to most of the other routes by 
which an investigator might generally 
choose to conduct this type of research, 
such as with a waiver of informed 
consent, which allows research to take 
place regardless of the wishes of the 
person whose information or 
biospecimens are being studied, and 
without their knowledge. In addition, in 
response to the public’s concerns that 
broad consent would not be meaningful, 
some of the elements of broad consent 
have changed from what was proposed 
in the NPRM to require more specific 
information about the research that may 
be conducted. As discussed in the 
NPRM, one of the main purposes of the 
final rule is to facilitate the conduct of 
minimal risk research, while enhancing 
subjects’ autonomy. We believe that the 
option to obtain broad consent furthers 
this goal. 

It is important to recognize that broad 
consent is a permissible option only for 
secondary research. Secondary research 
is limited to research using identifiable 
private information or identifiable 
biospecimens that are collected for 
either research studies other than the 
proposed research or nonresearch 
purposes. It is not permissible to obtain 
broad consent for any other type of 
research (e.g., research involving the 
collection of information or 
biospecimens through a research 
interaction or intervention with a 
subject). The informed consent 
requirements in § _.116(b) and (c) 
will be applicable to all human subjects 
research for which broad consent is not 
an option. However, it is envisioned 
that research requiring study-specific 
consent, such as research involving the 
collection of information or 
biospecimens through a research 
interaction or intervention with a 
subject, will sometimes also involve 
seeking subjects’ broad consent for the 
secondary research use of identifiable 
private information or identifiable 
biospecimens obtained as part of the 
original research study. 

When broad consent is obtained, the 
general requirements for informed 
consentin§ _.116(a) apply, except 
that the requirements at § —_—.116(a)(5) 


(imposing certain requirements 
concerning the presentation of 
information for informed consent and 
prescribing the order in which consent 
information is presented) do not apply 
to broad consent. 

We expect that, given the different 
requirements set forth for study-specific 
consent and broad consent, some 
institutions and investigators may elect 
to pursue study-specific consents for the 
storage, maintenance, and secondary 
research uses of identifiable private 
information and identifiable 
biospecimens (or for some subset of 
such research) whereas other 
institutions and investigators may elect 
to pursue broad consent for the same 
types of research (or for some subset of 
such research). For instance, with regard 
to the public comments raising concern 
about broad consent being sought from 
AI/AN peoples, it is expected that 
institutions, investigators, and IRBs will 
consider these concerns when 
determining when it might be 
appropriate to seek study-specific 
consent for the secondary research use 
of identifiable biospecimens, as well as 
the need for tribal consent, when 
appropriate. 

Perhaps even more commonly, 
however, given that the NPRM proposal 
regarding generally requiring consent 
for research use of nonidentifiable 
biospecimens has not been adopted, 
many investigators may choose to use 
the routes that previously existed under 
the pre-2018 rule, and will continue to 
exist, for conducting such research 
without informed consent under the 
Common Rule. Those options include 
using nonidentifiable biospecimens, 
including perhaps having a code 
maintained that will allow the 
investigator to obtain additional 
information about the subjects, or 
obtaining a waiver from an IRB of the 
need to obtain informed consent. 

The broad consent provision in the 
final rule is different in three main ways 
from what was proposed in the NPRM. 
First, consistent with the decision not to 
revise the definition of human subject to 
include biospecimens regardless of 
identifiability, the broad consent 
provisionin § _.116(d) only applies 
to secondary research using identifiable 
private information and identifiable 
biospecimens. 

Second, the elements of broad consent 
have been strengthened and simplified 
in response to public comments. The 
final rule strengthens the element of 
broad consent proposed in the NPRM 
regarding the need to provide a general 
description of the types of research that 
may be conducted with identifiable 
private information and identifiable 
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biospecimens. It does this by requiring 
that this description must include 
sufficient information to allow a 
reasonable person to expect that the 
broad consent would permit the types of 
research conducted. This “reasonable 
person”’ standard is consistent with the 
interpretation that the Office for Civil 
Rights provided for authorization 
obtained from an individual for the use 
or disclosure of protected health 
information for future research 
purposes. In addition, the final rule has 
been strengthened to require that when 
subjects will not be informed about the 
details for any specific research studies 
that might be conducted using their 
identifiable private information or 
identifiable biospecimens, the broad 
consent must disclose this fact and 
inform subjects that they might have 
chosen not to consent to some of those 
specific research studies. It is 
envisioned that for certain types of 
research, such as research for which 
there is reason to believe some subjects 
will find the research controversial or 
objectionable, a more robust description 
of the research will be required in order 
to meet this ‘‘reasonable person” 
standard. This requirement has been 
included in the final rule in recognition 
of the concerns raised by some public 
commenters that broad consent would 
not be meaningful because it will not 
provide detailed information about 
specific research studies that might be 
conducted with the individual’s 
identifiable private information or 
identifiable biospecimens. 

As proposed in the NPRM, the final 
rule permits broad consent to be sought 
for either a narrow type of research to 
be conducted in the future (e.g., cancer 
research), or a broader scope of research. 
Given this flexibility, while the final 
rule includes an exemption for 
secondary research for which broad 
consent is required, the exemption is 
contingent on several criteria being 
satisfied, including that an IRB 
determines that the research to be 
conducted is within the scope of the 
broad consent (§__-.104(d)(8)). This 
exemption is further discussed in 
Section V. For research that is not 
exempt, the IRB is expected to assess 
whether the description of the research 
included in the broad consent form is 
adequate to permit a reasonable person 
to expect that they were providing 
consent for the currently proposed 
secondary research study. 

While strengthening the broad 
consent requirements, the final rule also 
adopts simplified and more flexible 
elements of broad consent than what 
was proposed in the NPRM. For 
example, the final rule requires that the 


broad consent include a description of 
the identifiable private information or 
identifiable biospecimens that might be 
used in research, whether sharing of 
such information or biospecimens might 
occur, and the types of institutions or 
investigators that might conduct 
research with such information or 
biospecimens. However, the final rule 
does not adopt the NPRM’s proposed 
limitations on the research use of 
biospecimens or identifiable private 
information obtained for nonresearch 
purposes, that would have only 
permitted a broad consent to cover 
either or both of the following: (1) 
Biospecimens or identifiable private 
information that exist at the time at 
which broad consent is sought; and (2) 
biospecimens or identifiable private 
information that will be collected up to 
10 years after broad consent is obtained 
or until the child reaches the legal age 
of consent to the treatments or 
procedures involved in the research, 
whichever comes first. We were 
persuaded by the public comments that 
raised concerns about the complexity 
and tracking burden that such 
limitations would impose, without 
clearly offering individuals a more 
meaningful way to control the use of 
their information or biospecimens. 

In addition, the broad consent 
requirements have been simplified to 
avoid creating redundant requirements 
with the basic elements of informed 


consent under § .116(b) that must 
also be included in broad consent 
obtained under § .116(d). For 


example, in the final rule, it is required 
that broad consent include a statement 
that participation is voluntary, refusal to 
participate will involve no penalty or 
loss of benefits to which the subject is 
otherwise entitled, and the subject may 
discontinue participation at any time 
without loss of benefits to which the 
subject is otherwise entitled 
((§__—«.116(d)(1), incorporating 
§ __.116(b)(8) for broad consent). 
Therefore, the comparable element of 
broad consent that was proposed in the 
NPRM is not included in the final rule. 
As discussed in the NPRM, we expect 
that, when appropriate, this element of 
broad consent will inform subjects that 
information that has been stripped of 
identifiers might not be traceable, and 
thus it might not be feasible to withdraw 
consent for future use or distribution in 
this case. However, if an investigator 
commits to permitting a subject to 
discontinue use of the subject’s 
identifiable private information or 
identifiable biospecimens, it is expected 
that the investigator will honor this 
commitment by not removing 
identifiers. 


Similarly, the final rule also does not 
include the element of broad consent 
proposed in the NPRM that, when 
relevant, would have required the broad 
consent to include an option for an 
adult subject or the representative to 
consent, or refuse to consent, to the 
inclusion of the subject’s data, with 
removal of the identifiers listed in 45 
CFR 164.514(b)(2)(i)(A) through (Q), in 
a database that is publicly and openly 
accessible to anyone, and that this 
option be prominently noted and 
include a description of the risks of 
public access to the data. We believe 
this proposed requirement is 
unnecessary because it overlaps with 
the broad consent elements included in 
the final rule requiring a statement 
describing the extent, if any, to which 
confidentiality of records identifying the 
subject will be maintained 
(§_—.116(d)(1), incorporating 
§ _.116(b)(5) for broad consent), and 
a description of any reasonably 
foreseeable risks or discomforts to the 
subject (§__.116(d)(1), incorporating 
§ _.116(b)(2) for broad consent). 

The final rule includes a slightly 
different provision relating to the return 
of research results than that proposed in 
the NPRM. As set forth in 
§ _.116(d)(6) of the final rule, unless 
it is known that clinically relevant 
research results, including individual 
research results, will be disclosed to the 
subject in all circumstances, a statement 
that such results may not be disclosed 
to the subject must be included in the 
broad consent. This element of broad 
consent differs from the related 
requirement in § _.116(c)(8) that 
pertains when an investigator is seeking 
consent for a specific study, since 
unlike the circumstances under which 
broad consent is likely to be sought, 
investigators seeking consent for a 
specific study will know if the study 
includes a plan to return research 
results to subjects. The NPRM proposed 
that a general element of informed 
consent be included as part of a broad 
consent, namely that the consent 
include a statement regarding whether 
clinically relevant research results, 
including individual research results, 
would be disclosed to subjects, and if 
so, under what conditions. The language 
adopted in the final rule is intended to 
provide transparency, but is tailored to 
the broad consent context as those 
seeking broad consent may not know 
whether clinically relevant research 
results, including individual research 
results, will always be disclosed to 
subjects, and if so, under what 
conditions. Nonetheless, unless 
investigators know that such results will 


7222 


Federal Register/Vol. 82, No. 12/Thursday, January 19, 2017/Rules and Regulations 








be disclosed to subjects in all 
circumstances, subjects will be 
informed through a broad consent of the 
possibility that such results will not be 
disclosed to them. This provision is 
intended to pertain to all clinically 
relevant research results, including 
general or aggregate research findings 
and individual research results. This 
element of broad consent will affect the 
applicability of the exemption set forth 
at§ _—«.104(d)(8), for secondary 
research for which broad consent is 
required. This exemption applies only if 
the investigator does not include 
returning individual research results to 
subjects as part of the study plan 
(noting, however, that this provision 
does not prevent an investigator from 
abiding by any legal requirements to 
return individual research results). 
Although it is envisioned that broad 
consent will often be sought with the 
expectation that specific secondary 
research studies using identifiable 
private information or identifiable 
biospecimens will be exempt under 

§ _.104(d)(8), this will not always be 
the case. Broad consent can also be 
obtained for secondary research that 
will not qualify for this exemption, such 
as secondary research that will involve 
returning clinically relevant research 
results to subjects. In these cases, the 
specific secondary research study will 
need to undergo IRB review and 
approval under§ __.111, and we 
expect that the IRB would consider 
what subjects were told in the broad 
consent regarding the return of research 
results. The only exception to the 
requirement for IRB review of such 
research, if covered by this policy, is if 
the research qualifies for another 
exemption or the research is carried out 
under a Secretarial waiver at 

§ _.101(i). 

Finally, the third main difference 
between the NPRM and final rule 
provision on broad consent is that the 
final rule does not include broad 
consent templates to be established by 
the Secretary of HHS. We agree with the 
public comments that favored allowing 
institutions to create their own broad 
consent forms that could be tailored to 
a variety of circumstances. Therefore, 
under the final rule, investigators and 
institutions may develop broad consent 
forms, which, provided specified 
conditions are satisfied, would meet the 
exemption for the storage and 
maintenance for secondary research use 
of identifiable biospecimens or 
identifiable private information 
(§___.104(d)(7)). This exemption is 
further discussed in Section V. At a later 
time, the Secretary of HHS expects to 


develop guidance on broad consent, 
which could include broad consent 
templates. 

In addition, we are also including in 
the final rule an element that for 
research involving biospecimens, when 
appropriate, the broad consent must 
state whether the research will (if 
known) or might include whole genome 
sequencing (WGS) (§__—.116(d)(1), 
incorporating § _.116(c)(9)). The 
reasons for requiring this element in the 
broad consent are similar to those 
discussed above regarding the addition 
of this requirement in the additional 
elements of consent at § _—_.116(c)(9). 
WGS generates an extremely large 
amount of data, which when analyzed 
can yield information about an 
individual, including factors that could 
contribute to their future medical 
conditions. Therefore, given the 
implications of WGS information for an 
individual and his or her biological 
family, if it is known that the broad 
consent will or might permit the use of 
individuals’ biospecimens for WGS, we 
believe that this aspect of the research 
must be disclosed to prospective 
subjects as part of the broad consent 
process. The broad consent must 
include a general description of the 
types of research that may be conducted 
with the identifiable private information 
or identifiable biospecimens, with 
sufficient information to allow a 
reasonable person to expect that the 
broad consent would permit the types of 
research conducted (§__.116(d)(2)). 
Including an additional element of 
broad consent that specifically 
addresses WGS makes it clear that such 
information must be disclosed to 
prospective subjects. 

Under the final rule, if the subject or 
the subject’s legally authorized 
representative is asked to provide broad 
consent, the broad consent must satisfy 
the general informed consent 
requirements at§ _—_—.116(a)(1)-(4), and 
(a)(6), and must include all of the 
following 12 elements that are 
applicable: 

e A description of any reasonably 
foreseeable risks or discomforts to the 
subjects (§___—.116(d)(1), incorporating 
basic elements of informed consent in 
§___.116(b)(2)); 

e A description of any benefits to the 
subject or to others that may reasonably 
be expected from the research 
((§___—.116(d)(1), incorporating basic 
elements of informed consent in 
§__.116(b)(3); 

e A statement describing the extent, if 
any, to which confidentiality of records 
identifying the subject will be 
maintained ((§ __—.116(d)(1), 


incorporating basic elements of 
informed consent in § .116(b)(5)); 

e A statement that participation is 
voluntary, refusal to participate will 
involve no penalty or loss of benefits to 
which the subject is otherwise entitled, 
and the subject may discontinue 
participation at any time without 
penalty or loss of benefits to which the 
subject is otherwise entitled 
((§___-.116(d)(1), incorporating basic 
elements of informed consent in 
§___.116(b)(8)); 

e If applicable, a statement that the 
subject’s biospecimens (even if 
identifiers are removed) may be used for 
commercial profit and whether the 
subject will or will not share in this 
commercial profit ((§____.116(d)(1), 
incorporating additional elements of 
consentin§ _.116(c)(7)); 

e When appropriate, for research 
involving biospecimens, whether the 
research will (if known) or might 
include WGS (i.e., sequencing of a 
human germline or somatic specimen 
with the intent to generate the genome 
or exome sequence of that specimen.) 
((§___-.116(d)(1), incorporating the 
additional element of consent in 
§___.116(c)(9)); 

e A general description of the types of 
research that may be conducted with 
identifiable private information or 
identifiable biospecimens. This 
description must include sufficient 
information to permit a reasonable 
person to expect that the broad consent 
would permit the types of research 
conducted (§ .116(d)(2)); 

e A description of the identifiable 
private information or identifiable 
biospecimens that might be used in 
research, whether sharing of such 
information or biospecimens might 
occur, and the types of institutions or 
investigators that might conduct 
research with such information or 
biospecimens (§ .116(d)(3)); 

e A description of the period of time 
allowed that the identifiable private 
information or identifiable 
biospecimens may be stored and 
maintained (which period of time could 
be indefinite), and a description of the 
period of time that such information or 
biospecimens may be used for research 
purposes (which period of time could be 
indefinite (§___—.116(d)(4)); 

e Unless the subject or legally 
authorized representative will be 
provided details about specific research 
studies, a statement that they will not be 
informed of the details of any specific 
research studies that might be 
conducted using the subject’s 
identifiable private information or 
identifiable biospecimens, including the 
purposes of the research and that they 
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might have chosen not to consent to 
some of those specific research studies 
(§__.116(d)(5)); 

e Unless it is known that clinically 
relevant research results, including 
individual research results, will be 
disclosed to the subject in all 
circumstances, a statement that such 
results may not be disclosed to the 
subject; (§___—.116(d)(6)); and 

e An explanation of whom to contact 
for answers to questions about the 
subject’s rights about storage and use of 
the subject’s identifiable private 
information or identifiable 
biospecimens, and whom to contact in 
the event of a research-related harm 
(§__.116(d)(7)). 

The elements of broad consent 
described in the first six bullet points 
above are not unique to broad consent, 
while the elements described in the last 
six bullet points are specific to the 
requirements of broad consent. 


E. Waiver or Alteration of Informed 
Consent Involving Public Benefit and 
Service Programs (§ .116(e)) 


1. Background and Pre-2018 
Requirements 


The pre-2018 rule permitted an IRB to 
waive the requirements for obtaining 
informed consent, or to alter such 
requirements, under two sets of 
circumstances described at § _.116(c) 
or (d) of the pre-2018 rule. The first set 
of circumstances, described at 
§ _.116(c) of the pre-2018 rule was 
more narrow and was limited to certain 
research or demonstration projects 
conducted by or subject to the approval 
of state or local government officials. 
These projects are similar in some ways 
to the projects identified in the 
exemption at§ _.104(d)(5) of this 
final rule. The broader provisions 
concerning waivers or alterations of the 
requirements of informed consent that 
apply beyond the circumstances 
described in § _.116(c) of the pre- 
2018 rule are discussed below in the 
section concerning § _.116(f). 


2. NPRM Proposal 


The NPRM proposed retaining the 
waiver and alteration of informed 
consent provisions included in the pre- 
2018 rule with respect to research 
involving public benefit and service 
programs conducted by or subject to the 
approval of state or local officials, with 
two exceptions. First, the NPRM 
proposed (for proposed § _.116(e)(2)), 
additional criteria for waiver or 
alteration of consent for biospecimens. 
This was tied to the NPRM’s proposal 
that all biospecimens, regardless of their 
identifiability, be covered under the 


Common Rule. Under these proposed 
criteria, IRBs would be able to approve 
waivers or alterations of the required 
informed consent elements only if an 
IRB found and documented both that 
there were compelling scientific reasons 
to conduct the research and that the 
research could not be conducted with 
other biospecimens for which informed 
consent was obtained or could be 
obtained. Second, the NPRM proposed 
new language (for proposed 

§ _.116(e)(3)), providing that if an 
individual was asked to consent to the 
storage or maintenance for secondary 
research use of biospecimens or 
identifiable private information in 
accordance with the proposed broad 
consent provisions and that individual 
refused to consent, the IRB would be 
prohibited from waiving consent for the 
storage, maintenance, or the secondary 
research use of the biospecimens or 
information. 


3. Response to Comments and 
Explanation of the Final Rule: Waiver or 
Alteration of Informed Consent 
Involving Public Benefit and Service 
Programs 


Public comments on this proposal are 
described in section F below because 
the comments submitted generally 
addressed the waiver and alteration 
criteria under both proposed 
§ _.116(e) and § _.116(f). 

The final rule adopts one of the two 
proposals made in the NPRM for 
proposed § _.116(e). The final rule 
adopts (in§ _—.116(e)(1)) the language 
proposed in the NPRM providing that if 
an individual was asked to consent to 
the storage or maintenance for 
secondary research use of identifiable 
private information or identifiable 
biospecimens in accordance with the 
proposed broad consent provisions and 
such individual refused to consent, the 
IRB would be prohibited from waiving 
consent for the storage, maintenance, or 
the secondary research use of such 
biospecimens or information. The 
references in this provision to 
biospecimens are changed to refer 
specifically to identifiable biospecimens 
as the final rule does not apply to the 
research use of nonidentifiable 
biospecimens. This change is intended 
to honor the autonomy of individuals 
and to further the Belmont Report 
principle of respect for persons, in that 
this provision will prevent an 
individual’s refusal to consent to 
additional research use of information 
or biospecimens from being overridden. 

The final rule does not incorporate 
the NPRM’s proposed additional waiver 
criterion to apply to research involving 
the use of biospecimens. This change is 


not necessary given that the proposal in 
the NPRM that the Common Rule 
extend to all biospecimens has not been 
adopted in the final rule. We 
determined that the waiver and 
alteration criteria included in the final 
rule are appropriately protective of 
identifiable biospecimens, as defined at 
§ _.102(e)(6) and that an additional 
waiver criterion for such biospecimens 
is not warranted. For example, 

§ _.116(e)(3)(ii) mandates that an IRB 
may not waive or alter the requirements 
of informed consent with respect to 
research under this category unless the 
research could not practicably be 
carried out without the waiver or 
alteration. 

The format and organization of 
§ .116(e) in the final rule is different 
from that included in the pre-2018 rule 
or proposed in the NPRM. These 
changes were implemented to be clearer 
about the effect of each requirement. 
Most significantly, § __.116(e) in the 
final rule provides separate paragraphs 
concerning the applicable criteria for 
waiver and the applicable criteria for 
alteration of the requirements for 
informed consent. This differs from the 
approach proposed in the NPRM, and 
the approach included in the pre-2018 
rule, that did not separate those 
discussions. We concluded that 
separating the discussion of waiver and 
the discussion of alteration would help 
clarify the applicable criteria, 
particularly given that the final rule 
addresses broad consent. 

Section _.116(e)(1) describes the 
general framework for an IRB to waive 
the requirements for informed consent. 
This paragraph explains that an IRB 
may waive the requirement to obtain 
informed consent under § _.116(a) 
(general requirements for informed 
consent), § _.116(b) (basic elements 
of informed consent), or § _—.116(c) 
(additional elements of informed 
consent that apply to certain research) if 
the IRB satisfies the criteria set forth at 
§ _.116(e)(3) (discussed below). As 
explained above, the ability to satisfy 
the requirement to obtain informed 
consent of a subject or a subject’s legally 
authorized representative through use of 
a broad consent in particular 
circumstances is a flexibility offered to 
institutions, but institutions are never 
required to obtain informed consent 
through a broad consent process. For 
this reason, § .116(e)(1) does not 
provide that an IRB may waive the 
requirement to obtain informed consent 
under § _.116(d) (broad consent) 
because use of broad consent is not a 
requirement. As noted above, and to 
honor the autonomy of individuals, 

§ _.116(e)(1) prohibits an IRB from 
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waiving consent for the storage, 
maintenance, or secondary research 
uses of identifiable private 
biospecimens or identifiable private 
information if an individual was asked 
to provide broad consent for such 
purposes and refused to provide such 
consent. 

Section _.116(e)(2) describes the 
general framework for an IRB to alter the 
requirements for informed consent. An 
IRB may omit or alter some or all of the 
elements of informed consent under 
§ _.116(b) (basic elements of 
informed consent) or § _.116(c) 
(additional elements of informed 
consent that apply to certain research) if 
the IRB satisfies the criteria set forth at 
§ _.116(e)(3) (discussed below). This 
is consistent with the proposal made in 
the NPRM. This paragraph further 
explains that an IRB may not omit or 
alter any of the requirements described 
in§ _.116(a) (general requirements 
for informed consent). This is also 
consistent with the proposal made in 
the NPRM (which proposed permitting 
an IRB to omit or alter elements of 
informed consent, but did not propose 
permitting omissions or alterations of 
the general requirements of informed 
consent that were included in the 
unnumbered introductory paragraph in 
the pre-2018 rule at § .116). This 
paragraph also specifies that if a broad 
consent is used, an IRB may not omit or 
alter any of the elements required under 
§ _.116(d). We determined that it 
would not be appropriate to permit the 
omission or alteration of any of the 
broad consent elements given the fact 
that the required elements of broad 
consent are limited and given our view 
that each of these elements (described at 
§ .116(d)) is critical for the purpose 
of soliciting broad consent that is both 
informed and ethically appropriate. 
This approach is different from what 
was proposed in the NPRM because of 
the NPRM’s different approach to broad 
consent than that adopted in the final 
rule. 

Section _.116(e)(3) sets forth the 
specific criteria that an IRB must find 
and document to waive or alter the 
requirements for informed consent, 
consistent with the limitations set forth 
in§ _.116(e)(1) and § .116(e)(2). 
These criteria are the same as those 
proposed in the NPRM. First, the IRB 
must find and document that the 
research or demonstration project is to 
be conducted by or subject to the 
approval of state or local government 
officials and is designed to study, 
evaluate, or otherwise examine public 
benefit or service programs; procedures 
for obtaining benefits or services under 
those programs; possible changes in or 











alternatives to those programs or 
procedures; or possible changes in 
methods or levels of payment for 
benefits or services under those 
programs. Second, the IRB must find 
and document that the research could 
not practicably be carried out without 
the waiver or alteration. 


F. General Waiver or Alteration of 
Informed Consent (§ .116(f)) 


1. Background and Pre-2018 
Requirements 


Beyond the circumstances addressed 
in§ _.116(c) of the pre-2018 rule 
(which is limited to certain research 
conducted by or subject to the approval 
of state or local government officials), 
the pre-2018 rule includes a more 
general provision that is not limited to 
any particular type of research and that 
permits an IRB to either waive the 
requirements for obtaining informed 
consent, or to alter such requirements. 
Waiver or alteration of the requirements 
of informed consent under this general 
provision requires that the following 
four criteria be satisfied: (1) the research 
involves no more than minimal risk to 
the subjects; (2) the waiver or alteration 
will not adversely affect the rights and 
welfare of the subjects; (3) the research 
could not practicably be carried out 
without the waiver or alteration; and (4) 
whenever appropriate, the subjects will 
be provided with additional pertinent 
information after participation. 

Concerns have been expressed that 
requirements for obtaining waivers of 
informed consent or waivers of 
documentation of informed consent 
were confusing and inflexible, resulting 
in inconsistent application and a lack of 
uniformity in interpretation, which led 
to the proposals in the NPRM. 


2. NPRM Proposals 


The NPRM offered three substantive 
proposals related to the general waiver 
or alteration of informed consent 
provisions. First, the NPRM proposed to 
add a new waiver criterion that would 
require that for research involving 
access to or use of identifiable 
biospecimens or identifiable private 
information, the requirements of 
informed consent could only be waived 
or altered if the research could not 
practicably be carried out without 
accessing or using identifiers. This 
criterion was modeled on the 
comparable criterion in the HIPAA 
Privacy Rule, which requires as a 
condition of waiver of the requirement 
to obtain an individual’s authorization 
that the research could not practicably 
be conducted without access to and use 
of protected health information. The 


principle embodied in this additional 
proposed criterion was that 
nonidentified information should be 
used whenever possible in order to 
respect subjects’ interests in protecting 
the confidentiality of their data and 
biospecimens. 

Second, the NPRM proposed two 
additional waiver criteria for research 
involving the use of biospecimens. For 
such research, the NPRM proposed that 
the requirements of informed consent 
could only be waived or altered if an 
IRB found and documented that: (1) 
there were compelling scientific reasons 
for the research use of the biospecimens; 
and (2) the research could not be 
conducted with other biospecimens for 
which informed consent was or could 
be obtained. 

Third, the NPRM proposed that the 
Common Rule prohibit IRBs from 
waiving informed consent if individuals 
were asked and refused to provide broad 
consent to the storage and maintenance 
for secondary research use of 
biospecimens and identifiable private 
information. If a subject refused to 
provide broad consent, it was proposed 
that this refusal would need to be 
recorded by the investigator to better 
ensure that the subject’s wishes would 
be honored. 


3. Public Comments 


Approximately 975 public comments 
discussed the NPRM proposals found at 
§ _.116(f) either directly, or as related 
to linked provisions related to the 
definition of human subject, the broad 
consent proposal, or proposed 
exemptions. A majority of these 
discussed the NPRM proposals related 
to the more stringent waiver criteria for 
research involving biospecimens. A 
majority of these comments were from 
patients (including family members of 
patients) and other individuals who 
commented anonymously. Patients 
tended to oppose these proposals 
because they believed they would 
severely restrict access to biospecimens, 
which would slow research. Some 
commenters were opposed to waiver of 
consent under any conditions, whether 
specific or broad consent. 

Approximately 40 comments were 
received on the NPRM’s proposal to 
prohibit an IRB from waiving consent 
for the storage, maintenance, or 
secondary research uses of identifiable 
biospecimens or identifiable private 
information if an individual was asked 
to provide broad consent for such 
purposes and refused to provide such 
consent. Public comment was mixed. 
Those who supported it indicated that 
this requirement made sense in order to 
respect subject autonomy. Those who 
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opposed the proposal indicated that it 
would be impossible for an IRB to know 
the reasons why an individual refused 
to sign a broad consent form. Thus, 
these individuals argued, the 
prohibition on waiver of consent did not 
seem appropriate given the difficulty in 
understanding why someone refused to 
sign a broad consent form. Several 
commenters noted that it would be 
reasonable to prohibit an IRB from 
waiving a subject’s refusal to provide 
consent to a specific study, but that 
such a prohibition in the context of 
broad consent seemed unduly 
burdensome. 

The NPRM sought comments 
concerning language in the pre-2018 
rule (that the NPRM proposed retaining) 
that waiver or alteration of informed 
consent only occur if the IRB finds that 
the research could not practicably be 
carried out without the requested 
waiver or alteration. Several 
commenters recommended further 
defining or clarifying the meaning of 
“practicably.’’ Some members of the 
public felt that this criterion was too 
open-ended and that greater emphasis 
should be placed on respect for persons 
over other ethical concerns and 
scientific validity. Several commenters 
favored SACHRP’s recommendations on 
this topic, including that this 
requirement be interpreted to mean that 
it would be impracticable to perform the 
research, not impracticable to obtain 
consent due to financial or 
administrative burdens, without the 
waiver or alteration. Another 
commenter argued that because of a lack 
of clarity as to the meaning of terms 
including ‘‘minimal risk,” 
“practicably,” and ‘‘the rights and 
welfare of subjects,” as well as the 
potential that IRBs may not apply the 
criteria uniformly, IRBs should not be 
able to waive or alter consent. The 
following suggestions were offered as 
replacement language: ‘‘reasonably done 
without excessive time or financial 
constraints to the researcher that would 
delay the project so significantly as to 
make it impossible to conduct the 
research,” ‘“‘capable of being done or 
accomplished with available means or 
resources,’ “reasonably feasible,”’ 
“capable of being effective,’ and “could 
practicably be obtained.” Several 
commenters favored retaining the term 
“practicably” and were satisfied that it 
was Clear. 

Other comments raised different 
issues about waiver or alteration. Many 
commenters who opposed all classified 
research conducted without consent 
recommended that waivers be 
prohibited with respect to classified 
research involving humans. One 


commenter recommended a 
reorganization of the waiver and 
alteration provisions to clarify the 
different standards that apply to waivers 
and alterations. Another commenter 
expressed concern that the NPRM’s 
proposed waiver provision would 
unreasonably limit the flexibility of 
IRBs. One commenter believed that the 
§ _.116(f) alteration criteria were too 
rigid and that the final rule should 
incorporate a notion of risk adjustment. 
Another commenter (a professional 
medical organization) supported 
SACHRP’s proposed revisions to the 
waiver criteria at § _—.116(f) to allow 
an IRB to approve the storage, 
maintenance, and secondary research 
use of identified data. 

The NPRM sought public comment on 
the proposed differences between the 
criteria for waiving informed consent for 
the research use of biospecimens versus 
identifiable information. Approximately 
60 comments stated that no justification 
exists for treating biospecimens and 
information differently. Some also noted 
that the proposed criteria for waiver of 
consent for use of biospecimens is so 
high as to be virtually impossible to 
meet and asked why biospecimens 
should have a higher standard than 
information (which theoretically could 
be more easily identifiable). One 
commenter noted that the proposed 
waiver criteria promotes ‘‘biospecimen 
exceptionalism” and that data and 
biospecimens should be treated the 
same. 

A request in the NPRM for public 
comment on whether the proposal to 
permit an IRB to waive consent for 
research involving the use of 
biospecimens should be included in the 
regulations received few comments. One 
commenter noted that it seemed 
incongruous to include biospecimens in 
the definition of ‘human subject,” but 
then allow waiver based on different 
criteria. Others stated that IRBs should 
continue to have the ability to waive 
consent. 

The NPRM sought public comment 
regarding how likely investigators are to 
seek broad consent for the use of 
identifiable private information (as 
contrasted with biospecimens), given 
that the NPRM contains provisions that 
would make it easier to do such 
research without consent (such as the 
new exemption proposed for 
§ _.104(e)(2)). Approximately 30 
commenters responded to this question. 
A majority said they would not use the 
broad consent mechanism for secondary 
use of information if other options were 
available. Some said that they suspected 
that investigators would continue to 
seek consent waivers for secondary use 


of identifiable private information 
instead of seeking broad consent. 

The NPRM also sought public 
comment on several aspects of the 
proposed prohibition on waiving 
consent when an individual has been 
asked to provide broad consent and 
refused, including the following 
questions: In particular, how would this 
prohibition on waiving consent affect 
the secondary research use of 
identifiable private information? If an 
individual was asked to provide such 
consent, should the absence of a signed 
secondary use consent be considered a 
refusal? Does this prohibition on 
waiving consent for the secondary use 
of identifiable private information create 
a disincentive for institutions to seek 
broad consent for secondary use and 
instead seek a waiver of consent from an 
IRB? Under what circumstances, if any, 
would it be justified to permit an IRB to 
waive consent even if an individual 
declined or refused to consent? 

Approximately 35 comments were 
received on this set of questions. 
Approximately half of these stated that 
“no means no.” If someone was asked 
to give broad consent and the person 
specifically said no, researchers should 
not be allowed to obtain a waiver of 
consent. Those who opposed the idea of 
a prohibition on waiver argued that it 
would be very difficult for institutions 
to understand why someone said no to 
providing broad consent. In other 
words, a blanket prohibition does not 
accurately address all the issues that can 
occur in this situation. 

A majority of the responses did not 
address the questions of how a broad 
consent form with no indication either 
way should be treated. The responses 
we received to this question suggested 
that absence of a signed form should not 
be treated as if the individual explicitly 
said no to broad consent (i.e., that in 
those situations, waiver should be 
permitted). 

A majority of the responses that we 
received on the question of whether the 
prohibition on waiver in the broad 
consent context created a disincentive 
for the use of broad consent with 
identifiable private information 
answered in the affirmative. 


4. Response to Comments and 
Explanation of the Final Rule: General 
Waiver of Alteration of Consent 


Overall, two of the three proposals 
made in the NPRM for proposed 
§ _.116(f) have been retained. The 
final rule adopts (in § _—_—.11 6(f)(3) (iii) 
a new waiver criterion very similar to 
that proposed in the NPRM, which now 
mandates that for research involving 
access to or use of identifiable private 
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information or identifiable 
biospecimens, the requirements of 
informed consent can be waived or 
altered only if the research could not 
practicably be carried out without using 
such information or biospecimens in an 
identifiable format. The minor wording 
change made in the language of this 
provision, as compared with that 
proposed in the NPRM, is intended for 
clarity. This change is intended to 
protect the privacy of individuals, while 
not unduly inhibiting research. After 
considering the diversity of opinions 
expressed in the public comments on 
this issue, including many comments 
seeking further guidance concerning the 
proper interpretation of the 
“practicably” language, the final rule 
does not define this language (which 
was also included in the pre-2018 rule). 
We have concluded that the 
requirements for waiver and alteration 
in§ _.116(e) and (f) appropriately 
honor respect for persons and balances 
this with other ethical principles. 

The final rule also adopts (in 
§ _.116(f)(1)) the language proposed 
in the NPRM (for § _.116(f)(3)) 
prohibiting IRBs from waiving informed 
consent if individuals were asked and 
declined to provide broad consent to the 
storage and maintenance for secondary 
research use of identifiable private 
information or identifiable 
biospecimens (except that the final 
rule’s formulation is limited to 
identifiable biospecimens, consistent 
with changes made in the final rule). We 
considered public comments that 
opposed this prohibition and 
understand that IRBs may not always 
understand the reason that individuals 
refused to sign a consent form and that 
the effects of this broad prohibition 
could be significant in the context of 
broad consent (given the broad scope of 
research that such a broad consent 
could potentially extend to). 
Nonetheless, we determined that it is 
important to prevent an individual’s 
refusal to consent to additional research 
use of such information or biospecimens 
from being overridden. This change to 
the Common Rule is intended to honor 
the autonomy of individuals and to 
further the Belmont Report principle of 
respect for persons. 

The final rule does not incorporate 
the NPRM’s proposed additional waiver 
criteria (proposed for § _.11 6(f)(2)) to 
apply to research involving the use of 
biospecimens. This change is not 
necessary given that the proposal in the 
NPRM that the Common Rule extend to 
all biospecimens regardless of their 
identifiability has not been adopted in 
the final rule. We determined that the 
waiver and alteration criteria included 


in the final rule are appropriately 
protective of identifiable biospecimens 
and that an additional waiver criterion 
for such biospecimens is not warranted. 
Forexample, § _.116(f)(3)(iii) in the 
final rule is a research criterion specific 
to research that involves using 
identifiable private information or 
identifiable biospecimens. Under this 
criterion, an IRB may not waive or alter 
requirements of informed consent with 
respect to such research unless the IRB 
finds and documents that the research 
could not practicably be carried out 
without using such information or 
biospecimens in an identifiable format. 

The format and organization of 
§ _.116(f) in the final rule are 
different from the proposed § _.116(f) 
described in the NPRM. We made these 
changes in an effort to be clear about the 
effect of each requirement. Most 
significantly, § _.116(f) in the final 
rule provides separate paragraphs 
concerning the applicable criteria for 
waiver and the applicable criteria for 
alteration of the requirements for 
informed consent. This differs from the 
approach proposed in the NPRM, and 
the approach included in the pre-2018 
rule that did not separate those 
discussions. We conclude that 
separating the discussion of waiver and 
alteration will help clarify the 
applicable criteria, particularly given 
that the final rule addresses the 
application of the waiver and alteration 
provisions in the context of broad 
consent. 

Section _.11 6(f)(1) describes the 
general framework for an IRB to waive 
the requirements for informed consent. 
This paragraph explains that an IRB 
may waive the requirement to obtain 
informed consent under § .116(a) 
(general requirements for informed 
consent), § _.116(b) (basic elements 
of informed consent), or § _.116(c) 
(additional elements of informed 
consent that apply to certain research) if 
the research satisfies the criteria set 
forth at § _.116(f)(3) (discussed 
below). As explained above, the ability 
to satisfy the requirement to obtain 
informed consent of a subject or a 
subject’s legally authorized 
representative through use of a broad 
consent in particular circumstances is a 
flexibility offered to institutions, but 
institutions are never required to obtain 
informed consent through a broad 
consent process. For this reason, 

§ _.116(f)(1) does not provide that an 
IRB may waive the requirement to 
obtain informed consent under 

§ _.116(d) (broad consent) because 
use of broad consent is a regulatory 
flexibility, and not a requirement. 
Consistent with the proposal made in 





the NPRM (proposed § .116(f)(3)), 
§ .116(f)(1) provides that if an 
individual was asked to provide broad 
consent for the storage, maintenance, 
and secondary research use of 
identifiable private information or 
identifiable biospecimens and refused to 
consent, an IRB cannot waive consent 
for either the storage, maintenance, or 
secondary research use of such 
biospecimens or information. 

Section __.116(f)(2) describes the 
general framework for an IRB to alter the 
requirements for informed consent. This 
paragraph explains that an IRB may 
omit or alter some or all of the elements 
of informed consent under § _.116(b) 
(basic elements of informed consent) or 
§ _.116(c) (additional elements of 
informed consent that apply to certain 
research) if the IRB satisfies the criteria 
set forth at§ _—.116(f)(3) (discussed 
below). This is consistent with the 
proposal made in the NPRM. This 
paragraph further explains that an IRB 
may not omit or alter any of the 
requirements described in § _.116(a) 
(general requirements for informed 
consent). This is also consistent with 
the proposal made in the NPRM (which 
proposed permitting an IRB to omit or 
alter elements of informed consent, but 
did not propose permitting omissions or 
alterations of the general requirements 
of informed consent that were included 
in the unnumbered introductory 
paragraph in the pre-2018 rule at 
§ .116). This paragraph also 
specifies that when reviewing a broad 
consent, an IRB may not omit or alter 
any of the elements required under 
§ .116(d). As with §__.116(e)(2), 
we determined that it would not be 
appropriate to permit the omission or 
alteration of any of the broad consent 
elements in § .116(f). The elements 
of broad consent reflected in this NPRM 
are limited. We have concluded that 
each of these elements (which are 
included at § _.116(d)) is critical to 
the solicitation of an informed and 
ethically appropriate broad consent. For 
that reason, none of the elements of 
broad consent may be omitted or altered 
if broad consent is solicited. This 
prohibition is different than the NPRM’s 
proposal given the different formulation 
of broad consent represented in this 
final rule. 

Section 116(f)(3) sets forth the specific 
criteria that an IRB must find and 
document in order to waive or alter the 
requirements for informed consent. 
These criteria are the same as those 
proposed in the NPRM, except that the 
third criterion includes minor wording 
changes that were made for clarity: (1) 
the research involves no more than 
minimal risk to the subjects; (2) the 
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research could not practicably be 
carried out without the requested 
waiver or alteration; (3) if the research 
involves using identifiable private 
information or identifiable 
biospecimens, the research could not 
practicably be carried out without using 
such information or biospecimens in an 
identifiable format; (4) the waiver or 
alteration will not adversely affect the 
rights and welfare of the subjects; and 
(5) whenever appropriate, the subjects 
will be provided with additional 
pertinent information after 
participation. 


G. IRB Approval of Research Involving 
Screening, Recruiting, or Determining 
Eligibility of Prospective Subjects 
(§__.116(g)) 


1. Background and Pre-2018 
Requirements 


The pre-2018 rule required an IRB to 
determine that informed consent can be 
waived under § _.116(d) before 
investigators could record identifiable 
private information for the purpose of 
identifying and contacting prospective 
subjects for a research study. This 
requirement to waive informed consent 
has been viewed as burdensome and 
unnecessary for protecting subjects, and 
is not consistent with FDA’s regulations, 
which do not require informed consent 
or a waiver of informed consent for such 
activities. 


2. NPRM Proposal 


The NPRM proposed a new provision 
at§ _.116(g) that would authorize an 
IRB to approve a research proposal in 
which investigators obtain identifiable 
private information without individuals’ 
informed consent for the purpose of 
screening, recruiting, or determining the 
eligibility of prospective human subjects 
of research. The IRB would be permitted 
to approve a research proposal only in 
such circumstances if the proposal 
included an assurance that the 
investigator would implement standards 
for protecting the information obtained, 
in accordance with and to the extent 
required by proposed § _.105. This 
proposal was intended to address 
concerns that the pre-2018 rule required 
an IRB to determine that informed 
consent can be waived before 
investigators could record identifiable 
private information for the purpose of 
identifying and contacting prospective 
subjects for a research study. 


3. Public Comments 


Few comments were received 
regarding this proposal. All were 
generally supportive. One academic 
institution noted that ‘‘This review is 


unnecessary considering the low 
potential risk to subjects and will 
expedite research endeavors and ensure 
harmonization between FDA‘s 
expectations and the Common Rule.” 
However, one commenter thought that 
prospective subjects should be notified 
that this might be a possibility. Another 
commenter said that it should be clear 
that this is not an IRB waiver of consent, 
but rather it is an exception to the 
consent requirement. 


4. Response to Comments and 
Explanation of the Final Rule: Approval 
of Research Involving Screening, 
Recruiting, or Determining Eligibility of 
Prospective Subjects 

The final rule adopts the NPRM 
proposalat§ _.116(g), with minor 
changes made for clarity, and without a 
requirement that investigators adhere to 
the proposed privacy safeguards at 


§ .105, since this provision is not 
included in the final rule. The provision 
at § .116(g) addresses concerns that 


the pre-2018 regulations required an IRB 
to determine that informed consent can 
be waived before investigators may 
record identifiable private information 
for the purpose of identifying and 
contacting prospective subjects for a 
research study. This change is intended 
to address these concerns by eliminating 
the requirement for the IRB to waive 
informed consent for these activities. In 
response to public comments, we are 
clarifying that this is not a waiver of the 
consent requirement but rather an 
exception to the requirement. This 
change is also responsive to SACHRP’s 
recommendation regarding how the 
Common Rule should apply to activities 
that are conducted before subjects 
provide consent to participate in 
research, such as identifying potential 
subjects, contacting subjects, and 
recruiting subjects.48 

The final rule includes some minor 
changes from the NPRM proposal, to 
clarify the circumstances in which the 
IRB may approve the investigator’s 
proposal to obtain information directly 
from a prospective subject, or to obtain 
already collected identifiable private 
information or identifiable 
biospecimens by accessing records or 
stored biospecimens, for purposes of 
screening, recruiting, or eligibility 
assessment, without the informed 


48 See Secretary’s Advisory Committee on Human 
Research Protections (SACHRP). Attachment C: 
Approved by SACHRP July 20, 2011. SACHRP 
Recommendation regarding application of 45 CFR 
46 and 21 CFR 56 to early processes in research, 
such as identifying potential subjects, contacting 
subjects and recruiting subjects. (July 20, 2011). 
Retrieved from http://www.hhs.gov/ohrp/sachrp- 
committee/recommendations/2011-october-13- 
letter-attachment-c/index.html. 


consent of the prospective subject or the 
subject’s legally authorized 
representative. The final rule also adds 
a reference to the subject’s legally 
authorized representative at 

§ _.116(g)(1) to clarify that this 
exception to informed consent will also 
apply in circumstances in which the 
prospective subject has a legally 
authorized representative who will 
provide information about the 
prospective subject through oral or 
written communication with the 
investigator. 

We note that in approving this 
exception to informed consent for the 
purpose of screening, recruiting, or 
determining the eligibility of 
prospective subjects, the IRB will be 
reviewing and approving the entire 
research proposal. Therefore, all of the 
IRB approval criteria at § ——_.111 will 
need to be satisfied, including that 
when appropriate, there are adequate 
provisions to protect the privacy of 
subjects and to maintain the 
confidentiality of data(§_—_.111(a)(7)). 
Thus, as part of its review and approval 
of the research, the IRB must determine 
that there are adequate privacy and 
confidentiality safeguards for 
information obtained by investigators 
for these preparatory-to-research 
activities. 

We believe that these preparatory-to- 
research activities are critical means by 
which to identify subjects that do not 
involve additional risks, given their 
limited nature. If prospective subjects 
are identified through these “screening” 
activities, then all other relevant 
requirements of this rule must be met if 
they are subsequently recruited to 
participate in the research. 


H. Posting of Consent Forms 
(§ .116(h)) 


1. Background and Pre-2018 
Requirements 


The pre-2018 rule did not have a 
requirement to post consent forms from 
clinical trials. 


2. NPRM Proposal 


The NPRM proposed a new provision 
that would require that a copy of the 
final version of the consent form (absent 
any signatures) for each clinical trial 
conducted or supported by a Common 
Rule department or agency be posted on 
a publicly available federal Web site 
that will be established as a repository 
for such consent forms. The name of the 
protocol and contact information would 
be required to be included with the 
submission of the consent form. Under 
the NPRM proposal, the consent form 
would have to be published on the Web 
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site within 60 days after the trial is 
closed for recruitment. 


3. Public Comments 


The NPRM proposal received 
approximately 130 comments, most of 
which opposed the proposal in whole or 
in part. Many commenters expressed 
concern that the proposal represented 
administrative burden without a 
corresponding increase in protections to 
human subjects or benefit to the 
research community. Some commenters 
felt that the proposal represented a 
waste of resources that would not 
increase compliance with the 
regulations, and might result in longer 
consent forms if researchers felt the 
need to include an abundance of 
additional information to protect against 
perceived regulatory noncompliance or 
legal challenge. These commenters 
expressed concern that the repository of 
posted consent forms might be used to 
seek out instances of noncompliance. 
For example, one large medical school 
indicated that the posting requirement 
creates a rich environment for litigation 
and represents an effort to publicly 
shame investigators to improve quality 
of documents that will not work. 

Other commenters, including some 
private research firms, were concerned 
that the proposal as drafted would not 
allow for the redaction of proprietary or 
institutionally sensitive information 
from consent forms before they would 
be posted to the Web site, and allow 
competing research entities access to 
detailed information about 
investigational drug or research 
programs beyond what is publicly 
available already. Additional concern 
was expressed about the proposed 
timeframe in which consent forms 
needed to be posted. Some felt that 
more time was needed. Other 
commenters felt it would be more 
beneficial to research participants if 
consent forms were posted before or 
during recruitment. In addition, some 
commenters felt that researchers should 
be allowed or encouraged to update 
posted consent forms if they are 
updated for the study. Others felt that 
requiring that consent forms be posted 
once (even if the forms were updated 
after being posted) would lead to 
potential confusion among research 
participants. For example, several 
commenters noted that should a subject 
participating in a trial see a consent 
form for a particular study that differed 
from the form that he or she originally 
signed, that discrepancy could cause 
unnecessary concern and confusion. 

Still other commenters expressed 
concern that the high volume of consent 
forms that would be posted as a result 


of this requirement would make the 
collection cumbersome and difficult to 
use, negating any potential benefit 
gained by increased transparency. 
Others expressed a concern that 
requiring all studies to post consent 
forms might lead to the perpetuation of 
poorly written forms, as researchers 
might use poor examples from the 
database to write their own informed 
consent documents in addition to 
excellent ones. A few major research 
universities suggested that guidance, 
best practices, or exemplary informed 
consent forms should be selected and 
shared publicly, rather than all 
informed consent forms. Some 
commenters suggested limiting the 
posting requirement to a subset of 
research studies, for example, to only 
high risk or large multi-institution 
studies. 


Those who supported the proposal 
agreed that it would help increase 
accountability and promote 
transparency in informed consent forms. 
To that end, a minority of commenters 
said that this proposal should be 
extended to all research that is subject 
to the Common Rule, not just to studies 
meeting the definition of a clinical trial. 
Some commenters supported the idea of 
publicly sharing informed consent 
documents but felt it would be best 
accomplished through guidance or 
optional posting. One federal level 
advisory committee supported the 
proposal and recommended the creation 
of robust guidance with the goal of 
minimizing confusion and misuse of the 
posted documents, and facilitating the 
use of the posted forms to educate 
investigators, institutions, and 
regulators to improve future informed 
consent documents and the informed 
consent process generally. Others felt it 
would be helpful to post additional 
information and documents along with 
consent forms. For example, one 
investigator suggested that copies of IRB 
proposals and decisions be made public 
along with approved informed consent 
documents to provide additional 
transparency and accountability. 
Another commenter suggested that 
investigators be given the option to post 
assessment tools for evaluating 
prospective subjects’ understanding of 
important study information. 


Both those who supported and 
opposed the proposal indicated that in 
terms of implementing this proposal, 
consent forms should be posted to 
ClinicalTrials.gov as opposed to creating 
a new federal Web site in order to limit 
the additional administrative burden 
that this proposal would impose. 


4. Response to Comments and 
Explanation of the Final Rule: Posting of 
Consent Forms 


The final rule adopts the NPRM 
proposal with some modifications and 
clarifications. The primary purpose of 
this provision is to improve the quality 
of consent forms in federally funded 
research by assuring that—contrary to 
current practices, under which it is 
often very difficult to ever obtain a copy 
of these documents—they eventually 
would become subject to public scrutiny 
and that they will provide useful 
models for others. The consent form 
plays a key role in making sure that 
someone asked to enter a clinical trial 
receives the information they need to be 
making an informed decision about 
whether to enroll in that trial. 
Accordingly, it also plays a key role in 
supporting and justifying the public’s 
trust in the integrity of our clinical trial 
enterprise. 

We are not persuaded by the 
arguments of those commenters who 
suggest that potential negative 
consequences of this proposal outweigh 
its benefits. Fundamentally, this 
proposal is about increasing the 
transparency of one of the most 
important aspects of our human subjects 
protection system. Increased 
transparency is in general a good thing, 
and in this instance, as in many others, 
it offers multiple benefits—including 
increased trust—at very low cost. This 
provision is not a form of shaming, but 
rather an effort to ask people to work 
together to create a system that will 
improve the quality of informed 
consent. Moreover, the new standards 
for determining the acceptable content 
of a consent form—including 
§ _.116(a)(5), which will require a 
concise presentation of key information 
at the beginning of the consent form— 
should counter any consequences of 
attempts to pad consent forms with 
additional information as a response to 
the posting requirement. 

We agree with the conclusions of 
SACHRP that implementing this 
proposal will indeed result in better 
consent forms. Having a repository of 
such forms freely available for analysis 
and public discussion will create 
multiple opportunities for improving 
these forms. In an era in which we have 
previously unheard of capabilities for 
analyzing textual material and 
processing large amounts of data, the 
fact that there will be a high volume of 
consent forms posted should be a minor 
impediment, if any, to the ability to 
learn from the content of this database. 

With regard to those who suggested 
that it would indeed be desirable to 
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make consent forms more public, but 
that posting should be optional, we note 
that nothing in the pre-2018 rule 
prevents the people in charge of 
research from making their consent 
forms public, yet that is rarely done. In 
order to significantly increase the 
transparency of this portion of our 
system for protecting subjects, we are 
finalizing this proposal. 

With regard to the commenters who 
were concerned that posting consent 
forms would create a rich environment 
for litigation, it is noteworthy that the 
existing evidence fails to suggest that 
there has been much ofa problem with 
regard to inappropriate litigation over 
clinical trials. Whatever disincentives 
currently exist for such litigation, it 
seems unlikely that the mere fact that 
consent forms would now be more 
available will dramatically alter such 
disincentives. With regard to the 
commenters who were concerned about 
the added regulatory burden, we note 
that this change, compared to the 
traditional costs of clinical trials, will 
add a relatively small amount of 
additional burden, one that is well 
justified in comparison to the likely 
increase in transparency. This new 
provision has specifically been designed 
to minimize that burden. And the final 
rule has been modified in a number of 
respects from the NPRM proposal in 
response to public comments. As 
discussed below in detail, the time by 
which a consent form must be posted 
has been greatly extended. That change 
would also address the concerns of 
some commenters that the posted 
consent forms might create confusion 
among research subjects. Furthermore, 
provisions have been added that allow 
for redaction, as necessary, of portions 
of consent forms. 

As a means of increasing transparency 
and facilitating the development of 
more informative consent forms, the 
final rule accordingly requires at 
§ _.116(h)(1) that for clinical trials 
conducted or supported by a Common 
Rule department or agency, a copy of an 
IRB-approved version of a consent form 
that was used to enroll subjects would 
need to be posted by the awardee or the 
federal department or agency 
conducting the trial on a publicly 
available federal Web site that will be 
established as a repository for such 
forms. Unlike the NPRM, which 
required that the “final version” of the 
consent form be posted, the final rule 
adds flexibility in merely requiring that 
it be an IRB-approved consent form that 
was used for enrollment purposes. 
There is accordingly no further 
restriction as to which version of a 
consent form (which might have been 


subject to many modifications over the 
course of time) must be posted. The 
final rule also gives greater flexibility 
than the NPRM proposal in terms of 
when that posting needs to be done. It 
can take place any time after the trial is 
closed to recruitment, so long as the 
posting is no later than 60 days after the 
last study visit by any subject (as 
required by the protocol). If the federal 
department or agency supporting or 
conducting the clinical trial determines 
that certain information should not be 
made publicly available on a federal 
Web site (e.g., confidential commercial 
information), the department or agency 
may permit appropriate redactions to 
the information posted. In rare 
instances, it could be the case that the 
federal department or agency would 
determine that the very existence of a 
particular clinical trial should not be 
publicly disclosed, in which case no 
posting relating to such a trial would be 
required. 

The final rule differs from the NPRM 
proposal in that it no longer specifies 
that certain information needs to be 
posted in addition to the consent form. 
This change eliminates the need for 
mandatory posting of information that 
might not be justified by the purposes 
of this provision. 

Only one posting would be required 
for each multi-institution study. There 
is accordingly no expectation that a 
version would need to be posted for 
each class of subjects in the study (for 
example, a posting both for adults and 
for minors), nor for each study site. 

We also note that this provision 
applies only to those clinical trials that 
are conducted or supported by a federal 
department or agency. 

A Web site will be developed by HHS, 
which could be used by other federal 
departments or agencies, or the other 
federal departments or agencies could 
create their own Web sites for the 
posting of these consent forms. Public 
posting of consent forms is intended to 
increase transparency, enhance 
confidence in the research enterprise, 
increase accountability, and inform the 
development of future consent forms. It 
is anticipated that the Web site will be 
searchable. With regard to the 
comments suggesting that 
ClinicalTrials.gov might be an 
appropriate choice as the Web site, we 
agree that such a choice has the 
possibility of minimizing administrative 
burdens. Using ClinicalTrials.gov has 
another advantage, in addition to what 
some of the commenters said. Many 
clinical trials funded by HHS have 
records in ClincialTrials.gov due to 
requirements that certain clinical trials 
register and submit results information 


to that database (section 402(j) of the 
Public Health Service Act and 42 CFR 
part 11, and other policies that 
incentivize trial registration and results 
submission, such as the NIH Policy on 
Dissemination of NIH-Funded Clinical 
Trial Information). The fact that these 
trials already have a record in the 
database will mean that the burden of 
submission of the informed consent 
document will be substantially lower. 
Accordingly, we will take these points 
into consideration as we determine 
what federal Web site will be used to 
implement this provision. 


XV. Documentation of Informed 
Consent (§ .117) 


A. Background and Pre-2018 
Requirements 


The pre-2018 rule at§ —.117 
described the requirements for 
documenting informed consent and 
when the waiver for obtaining a written 
and signed consent form was allowable. 


B. NPRM Proposals 


The NPRM proposed to alter the 
language at§ —.117(b)(1) to specify 
that the consent document should 
include only the language required by 
§ _.116, with appendices included to 
cover any additional information. 

In addition, the NPRM would make it 
explicit in the regulatory language at 
proposed § _.117(c)(1)(iii) that if the 
subjects are members of a distinct 
cultural group or community for whom 
signing documents is not the norm, so 
long as the research presents no more 
than minimal risk of harm to subjects 
and provided there is an appropriate 
alternative mechanism for documenting 
that informed consent was obtained, the 
requirement to obtain a signed consent 
form may be waived. Documentation 
must include a description as to why 
signing forms is not the norm for the 
distinct cultural group or community. 

Additionally, to facilitate the tracking 
of broad consent to storage or 
maintenance for secondary research use 
of biospecimens or identifiable private 
information, and to provide information 
to IRBs should IRB review be required, 
the NPRM proposed that waiver of 
documentation of consent for the 
research use of such biospecimens 
would not be allowed based upon a new 
provision at§ —_.117(c)(3). 

The NPRM also introduced the term 
“oral consent” in the context of the 
various provisions related to the broad 
consent for the storage, maintenance, 
and secondary use of biospecimens and 
identifiable private information. As a 
general matter, under the pre-2018 rule, 
individuals wanting to obtain oral 
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consent from subjects in a nonexempt 
research activity needed to seek a 
waiver of documentation of informed 
consent under § _.117(c). Therefore, 
the NPRM proposed to permit 
investigators to obtain oral broad 
consent for the storage, maintenance, 
and secondary research use in limited 
circumstances. Specifically, the NPRM 
proposals would allow an investigator 
to obtain oral broad consent if: 

e An investigator used the proposed 
broad consent template; 

e Investigators only sought oral broad 
consent only for the storage, 
maintenance, and secondary research 
use context for the use of identifiable 
private information, not for 
biospecimens; 

e If broad consent for the storage, 
maintenance, and secondary research 
use was obtained only as part ofa 
separate, primary research study; and 

e The oral broad consent was sought 
as part of the consent process in a study 
eligible for one specific exclusion or 
three specific exemptions related to the 
collection of identifiable information. 

Finally, the regulatory language 
proposed at§ —_.117(c)(4) was 
intended to clarify that waivers of 
documentation may not be permitted for 
research subject to regulation by FDA. 


C. Public Comments 


Approximately 15 comments were 
received on the proposals found in the 
NPRM at § .117. Several 
commenters discussing the proposed 
requirement at§ —_—.117(b)(1) 
indicated that even if consent forms are 
split into a primary document and 
appendices, there should be an 
expectation that the content included in 
the appendices are discussed with 
prospective subjects as part of the 
informed consent process. Although 
very few comments discussed the 
requirements of proposed 
§ _.117(b)(1) specifically, many of the 
comments discussing the NPRM 
proposal found in the introductory 
paragraph of § _.116 discussed the 
concept of including only the required 
information in the main body of a 
consent form, and all additional 
information in appendices. 

Few comments were received on the 
proposal foundin § —_.117(c)(1) (iii) 
that documentation of informed consent 
may be waived if consent is being 
sought amongst subjects who are 
members of a distinct cultural group or 
community in which signing forms is 
not the norm. Comments received on 
this proposal were generally favorable. 

Those who commented on the 
proposals related to oral broad consent 
indicated that the provisions were 





confusing and difficult to understand. 
We note that these proposals were 
found in the NPRM through a series of 
interrelated cross references in 

§§ _.116(d),_——.117(c), and 
___.104()(1)-(2). 

Several commenters discussed the 
statement foundin § _.117(c)(4) that 
waiver of documentation of consent is 
generally not permitted for research 
subject to regulation by the FDA. These 
commenters noted that this would be 
true regardless of whether this was 
included in the Common Rule. 
Additionally, commenters noted that if 
the FDA regulations ever permitted 
waiver of documentation of consent, the 
existence of this provision in the 
Common Rule might result in confusion 
and contradictory requirements for 
dually regulated research. 


D. Response to Comments and 
Explanation of the Final Rule: 
Documentation of Informed Consent 


The language at§ ——_—.117(b)(1) and 
(2) are altered in the final rule to 
conform to the requirements included at 
§ __.116, which are discussed above. 
The goalin§§ —=.116and__—_—.117 of 
the final rule is to facilitate a 
prospective subject’s or legally 
authorized representative’s 
understanding of the reasons why one 
might or might not want to participate 
in the research, in part by requiring that 
only the key information essential to 
decision making receive priority by 
appearing at the beginning of the 
consent document. In the final rule, 
these requirements also apply when a 
short form written informed consent 
process is used, or the requirement for 
written informed consent is waived. 

We agree with the majority of public 
comments that favored adding a new 
provision allowing a waiver of the 
requirement for a signed consent form if 
the subjects are members of a distinct 
cultural group or community for whom 
signing documents is not the norm, 
provided that the research presents no 
more than minimal risk of harm to 
subjects and there is an appropriate 
alternative method for documenting that 
informed consent was obtained. 
Therefore, this new provision is added 
at§ —_—-.117(c)(1)(iii). The final rule 
includes a reference to the subject’s 
legally authorized representative to 
clarify that this provision applies when 
a subject has a legally authorized 
representative who is a member of a 
distinct cultural group or community in 
which signing forms is not the norm. 

The final rule does not include the 
NPRM’s proposal at § __.117(c)(3) to 
prohibit a waiver of documentation of 
broad consent for the storage, 


maintenance, or secondary research use 
of biospecimens. 

Some of those who commented on the 
NPRM proposals related to oral broad 
consent found it to be unnecessarily 
confusing. In response to these 
comments, the final rule permits waiver 
of documentation of informed consent 
under § .117(c) when a broad 
consent procedure is used. No 
additional criteria or special restrictions 
apply. Additionally, the final rule 
removes all NPRM references to ‘‘oral 
consent” to reduce confusion. 

However, we expect that it will rarely 
be permissible to waive documentation 
of broad consent for the secondary 
research use of medical records or 
stored biospecimens because there will 
likely be a need to track which 
individuals have provided broad 
consent and which have not, so the 
informed consent would not be the only 
record linking the subject and the 
research as required for a waiver under 
§ _.117(c)(1)G). Additionally, when 
identifiable information and identifiable 
biospecimens are shared for a 
nonresearch purposes, the person’s 
consent is usually required, so we 
expect that documentation of consent 
often could not be waived under 
§ _.117(c)(1)(ii), which requires that 
the research involves only procedures 
for which written consent is not 
normally required outside of the 
research context. 

One instance when we believe it may 
be appropriate for the IRB to waive the 
requirement for a signed broad consent 
form is when the initial activity 
involved obtaining information from a 
person through oral communication, 
such as a phone survey, because there 
might not be an opportunity to obtain 
written broad consent from such 
individuals for the secondary research 
use of their information. In this 
scenario, documentation of broad 
consent could be waived under 
§ _.117(c)(1)(Gi) if the research 
presents no more than minimal risk of 
harm to subjects and involves no 
procedures for which written consent is 
normally required outside of the 
research context. In addition, it might be 
appropriate for an IRB to waive the 
requirement for a signed broad consent 
document under the provision included 
in the final rule related to when the 
subjects or their legally authorized 
representatives are members of a 
distinct cultural group or community for 
whom signing documents is not the 
norm, provided that the research 
presents no more than minimal risk of 
harm to subjects and an appropriate 
alternative method is available for 
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documenting that informed consent was 
obtained (§_.117(c)(1) (iii). 

The final rule also does not include 
the NPRM’s proposed clarification that 
waivers of documentation may not be 
permitted for research subject to 
regulation by FDA. Because this is not 
the only difference between what is 
permitted under the Common Rule and 
the FDA regulations, we determined 
that clarifying only this specific 
difference in the final rule is likely to 
create more confusion rather than 
provide clarification. 


XVI. Applications and Proposals 
Lacking Definite Plans for Involvement 
of Human Subjects (§ .118) 


A. Background and Pre-2018 
Requirements 


This provision of the pre-2018 rule 
stated that while an award or grant may 
be made for a project with indefinite 
plans to involve human subjects, that 
project must be reviewed by an IRB 
before human subjects may be involved. 


B. NPRM Proposals 


The NPRM language clarified that IRB 
review and approval was required 
before human subjects could be 
involved in a study unless the study 
was excluded under § _.101(b), 
waived under § .101(i), or exempted 
under § _.104(d), (e) or (f)(2). 


C. Public Comments 





No comments were received. 
D. Explanation of the Final Rule 


The final rule adopts the language of 
the NPRM, with updated citations. This 
provision makes explicit that it applies 
only to nonexempt human subjects 
research. 


XVII. Research Undertaken Without the 
Intention of Involving Human Subjects 
(§__.119) 


A. Background and Pre-2018 
Requirements 


This provision of the regulations 
outlines the process that an institution 
must undergo when a federally funded 
research project that was designed 
without the intention of involving 
human subjects later involves human 
subjects as defined by this policy. 


B. NPRM Proposals 


The NPRM proposed to add language 
to make clear that this provision applies 
only to nonexempt human subjects 
research. It also clarifies its reference to 
department or agency to mean a federal 
department or agency component 
supporting the research. 


C. Public Comments 
No comments were received. 


D. Explanation of the Final Rule 


The final rule adopts the language of 
the NPRM, with updated citations. This 
provision makes explicit that it applies 
only to nonexempt human subjects 
research, and clarifies the reference to 
department or agency to be a federal 
department or agency component 
supporting the research. 


XVIII. Conditions (§ .124) 


A. Background and Pre-2018 
Requirements 


This provision of the regulations 
allows departments and agencies to 
impose additional requirements on 
human subjects research when such 
requirements are deemed necessary for 
the protection of human subjects. 


B. NPRM Proposals 


The NPRM provided more specific 
language at§ _—.124, stating that with 
respect to any research project or any 
class of research projects the department 
or agency head of either the conducting 
or the supporting federal department or 
agency may impose additional 
conditions prior to or at the time of 
approval when in the judgment of the 
department or agency additional 
conditions are necessary for the 
protection of human subjects. 


C. Public Comments 


One commenter discussed this NPRM 
proposal, arguing that this would 
increase variance in implementation of 
the Common Rule, rather than promote 
harmonization as the NPRM suggested. 


D. Explanation of the Final Rule 


The final rule adopts the NPRM 
language, which clarifies the pre-2018 
rule by stating that the head of either the 
conducting or the supporting federal 
department or agency may impose 
additional conditions on research, when 
necessary for the protection of human 
subjects. 


XIX. Regulatory Impact Analyses 
A. Introduction 


HHS has examined the impacts of this 
final rule under Executive Order 12866 
on Regulatory Planning and Review 
(September 30, 1993); Executive Order 
13563 on Improving Regulation and 
Regulatory Review (January 18, 2011); 
the Regulatory Flexibility Act of 1980, 
Pub. L. 96-354 (September 19, 1980); 
the Unfunded Mandates Reform Act of 
1995, Pub. L. 104-4 (March 22, 1995); 
and Executive Order 13132 on 
Federalism (August 4, 1999). 


Executive Order 12866 directs 
agencies to assess all costs and benefits 
of available regulatory alternatives and, 
if regulation is necessary, to select 
regulatory approaches that maximize 
net benefits (including potential 
economic, environmental, public health 
and safety effects; distributive impacts; 
and equity). Executive Order 13563 is 
supplemental to and reaffirms the 
principles, structures, and definitions 
governing regulatory review as 
established in Executive Order 12866. 
HHS expects that this rule will have an 
annual effect on the economy of $100 
million or more in any one year and 
therefore is a significant regulatory 
action as defined by Executive Order 
12866. 

The Regulatory Flexibility Act (RFA) 
requires agencies that issue a regulation 
to analyze options for regulatory relief 
for small businesses if a rule has a 
significant impact on a substantial 
number of small entities.49 The RFA 
generally defines a ‘“‘small entity” as (1) 
a proprietary firm meeting the size 
standards of the Small Business 
Administration (SBA); (2) a nonprofit 
organization that is not dominant in its 
field; or (3) a small government 
jurisdiction with a population of less 
than 50,000 (states and individuals are 
not included in the definition of “small 
entity’’).5° HHS considers a rule to have 
a significant economic impact on a 
substantial number of small entities if at 
least 5 percent of small entities 
experience an impact of more than 3 
percent of revenue. HHS anticipates that 
the rule will not have a significant 
economic impact on a substantial 
number of small entities. Supporting 
analysis is provided in Section XIX.F 
below. 

Section 202(a) of the Unfunded 
Mandates Reform Act of 1995 51 requires 
that agencies prepare a written 
statement, including an assessment of 
anticipated costs and benefits, before 
proposing “‘any rule that includes any 
Federal mandate that may result in the 
expenditure by State, local, and tribal 
governments, in the aggregate, or by the 
private sector, of $100,000,000 or more 
(adjusted annually for inflation) in any 
one year.” The current threshold after 
adjustment for inflation is $146 million, 
using the most current (2015) implicit 
price deflator for the gross domestic 
product. HHS expects this rule to result 
in expenditures that will exceed this 
amount. 

Executive Order 13132 establishes 
certain requirements that an agency 


495 U.S.C. 603. 
505 U.S.C. 601. 
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must meet when it promulgates a rule 
that imposes substantial direct 
requirement costs on state and local 
governments or has federalism 
implications. HHS has determined that 
the rule will not contain policies that 
would have substantial direct effects on 
the States, on the relationship between 
the Federal Government and the States, 
or on the distribution of power and 
responsibilities among the various 
levels of government. The changes in 
the rule represent the Federal 
Government regulating its own program. 
Accordingly, HHS concludes that the 
rule does not contain policies that have 
federalism implications as defined in 
Executive Order 13132 and, 
consequently, a federalism summary 
impact statement is not required. 


B. Need for the Final Rule and Summary 


This final rule is being issued to 
modernize, strengthen, and make more 
effective the regulations for protecting 
human subjects in research. Although 
professional organizations have codes of 
conduct and guidelines for members 
conducting research, only the Federal 
Government has the authority to 
regulate the activities of institutions 
using public funds for human subjects 
research. Since the Common Rule was 
developed, the volume of research has 
increased, evolved, and diversified. 

Thus, the final rule includes a number 
of measures to address the issues 
described above. Provisions that 
strengthen the requirements for 
informed consent and promote 
transparency in the informed consent 
process include: (1) Requiring that the 
informed consent form be designed and 
presented in such a way that facilitates 
a prospective subject’s understanding of 
why one would want to participate in a 


research study or not; (2) revising and 
adding to the required elements of 
consent; (3) requiring for certain clinical 
trials the posting of a copy of at least 
one version of a consent form on a 
publicly available federal Web site; and 
(4) clarifying the conditions and 
requirements for waiver or alteration of 
consent to remove ambiguity, including 
a new provision that, under specific 
conditions, an IRB may approve a 
research proposal in which investigators 
obtain information without individuals’ 
informed consent for the purpose of 
screening, recruiting, or determining 
eligibility of prospective human subjects 
of research. 

Provisions that strengthen the extent 
to which regulations promotes the 
principle of respect for persons include: 
(1) Requiring that informed consent 
forms present the key information to 
potential subjects at the beginning of a 
consent process; (2) allowing 
investigators the option of obtaining 
broad consent from a potential subject 
for future, unspecified research use of 
identifiable private information and 
identifiable biospecimens; and (3) 
adding a provision that would prohibit 
a waiver of consent if someone has been 
asked to provide their broad consent for 
the storage, maintenance, and secondary 
research use of identifiable 
biospecimens or identifiable private 
information and refused to do so. 

New provisions that would allow 
IRBs greater flexibility to focus 
resources on higher-risk research 
include: (1) Distinguishing categories of 
activities that are deemed not to be 
research; and (2) expanding and 
clarifying categories of exempt research. 

Provisions that streamline or reduce 
burden for IRBs or institutions include: 
(1) Requiring consultation among the 


Common Rule agencies for the purpose 
of harmonizing guidance (to the extent 
appropriate); (2) eliminating an 
administrative requirement for reporting 
IRB membership; (3) removing the 
requirement that IRBs must review and 
approve grant applications; (4) 
eliminating, under certain 
circumstances, continuing review; (5) 
mandating the use of a single IRB for 
multi-institutional studies; and (6) 
holding IRBs not operated by an FWA- 
holding institution directly responsible 
for compliance when appropriate. 


1. Accounting Table 


Table 1 summarizes the quantified 
and nonquantified benefits and costs of 
all changes to the Common Rule. Over 
the 2017-2026 period, present value 
benefits of $1,904 million and 
annualized benefits of $223 million are 
estimated using a 3 percent discount 
rate; present value benefits of $1,494 
million and annualized benefits of $213 
million are estimated using a 7 percent 
discount rate. Present value costs of 
$528 million and annualized costs of 
$62.0 million are estimated using a 3 
percent discount rate; present value 
costs of $474 million and annualized 
costs of $67.0 million are estimated 
using a 7 percent discount rate. 
Nonquantified benefits include 
improved human subjects protections in 
research; enhanced oversight of research 
reviewed by IRBs not operated by an 
FWaA-holding institution; and increased 
uniformity in regulatory requirements 
among Common Rule departments and 
agencies. Nonquantified costs include 
the time needed for consultation among 
Common Rule agencies before federal 
guidance is issued. 


TABLE 1—ACCOUNTING TABLE OF BENEFITS AND COSTS OF ALL CHANGES 





Present value of 10 years 
by discount rate 
(millions of 2015 dollars) 


Annualized value over 10 
years by discount rate 
(millions of 2015 dollars) 





3 percent 


7 percent 3 percent 7 percent 





Benefits: 
Quantified Benefits 








1,904 








1,494 223 213 





Nonquantified Benefits: 


Improved human subjects protections in research; enhanced oversight in research reviewed by IRBs not operated by an FWA-holding insti- 
tution; and increased uniformity in regulatory requirements among Common Rule departments and agencies. 





Costs: 


Quantified Costs: .......ccccccccseccsscceeseteeesseees 


528 








474 62.0 67.0 











Nonquantified Costs: 


Time for consultation among Common Rule agencies before federal guidance is issued. 





Table 2 summarizes the quantified 
present value benefits and costs of each 


change to the Common Rule using a 3 
percent discount rate. 
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TABLE 2—ACCOUNTING TABLE OF QUANTIFIED BENEFITS AND COSTS OF EACH CHANGE 





Change 


Present value of 10 years 
at a 3 percent discount rate 
(millions of 2015 dollars) 





Benefits 


Costs 





Costs to Learn New Requirements and Develop Training Materials; OHRP Costs to Develop Training and 

Guidance Materials, and to Implement the RUIe .............:cccccceseeeeeeeeeeeeeeeeeeeeeeseaeeeaeecaeeseeeseeeeseeeeeaeeseeeseeeeeaeenaes 
Extending Oversight to IRBs Unaffiliated with an Institution Holding an FWA (impact to IRBs not operated by 

An FWA-HOIGINGMMSTILUTION) «secs ceckvcveeseleehvenctenastavertecccgesttysdeudleeusecd ces ieve eatbevveces vceasi@aeatiduniees des aurevestvoabedscesscteasees 
Excluding Activities from the Requirements of the Common Rule because They are not Research ...........eee 
Clarifying and Harmonizing Regulatory Requirements and Agency Guidance ..........cceeeeeeseeeeceeeeeeeeeeeneeeeeteeneeeas 
Modifying the Assurance Requirement .......... cece eee ceeeeeneeeneeceeeecneeseaeeceeeseaeesseescaeeseeesaeeseeeseeeseaeseeeessaeeeeeasonees 
Requirement for Written Procedures and Agreements for Reliance on IRBs Not Operated by the Engaged In- 

stitution (impact to FWA-holding institutions) 
Eliminating the Requirement that the Grant Application Undergo IRB Review and Approval .........::eseeees reese 










Expansion of Research Activities Exempt from Full IRB Review ........... cece cece eee eeeeeee 
Elimination of Continuing Review of Research Under Specific Conditions 


Amending the Expedited Review Procedures 


Cooperative Research (single IRB mandate in multi-institutional research) . 
Changes in the Basic Elements of Consent, Including Documentation 
Obtaining Consent to Secondary Use of Identifiable biospecimens and Identifiable private information .............. 
Elimination of Pre-2018 Rule Requirement to Waive Consent in Certain Subject Recruitment Activities ............. 
Requirement for Posting of Consent Forms for Clinical Trials Conducted or supported by Common Rule De- 

PartMent: OF AGSNCIOS: «ri ccccesteceseceesenceveccscescanceveaesebeveacecsacdonseestedtedescrecaccustacesneddecesdecsastestervevedvesatcarcevessduvevevenesees 
Alteration in Waiver for Documentation of Informed Consent in Certain Circumstances 







li caebstendau shee cesees 11.4 

B26 neki aera 

saves 798 0.37 

eth 148 41.0 

seat 130), aietsatenktecararsnenses 

Sane 538 157 

Shp ciate eases 4.62 
Lae Co: eens 

edsSaaiteaewee en 15.4 











C. Public Comments and Response to 
Public Comments 


1. General Comments 


Approximately 50 comments 
discussed the specific cost estimates 
provided in the NPRM’s Regulatory 
Impact Analyses (RIA). Several 
commenters strongly suggested that the 
final rule eliminate the proposals 
related to biospecimens, cooperative 
research, and expanding coverage to 
nonfederally funded clinical research 
because the NPRM failed to appreciate 
the cost and burden that would result 
from implementing these proposals. 
Although a majority of the comments 
received on the RIA suggested that 
several of the cost estimates were 
significantly underestimated, few 
commenters described specific changes 
to the cost and benefit estimates 
included in the NPRM RIA. 

One commenter noted that the NPRM 
cost estimates are derived from a 1998 
NIH-sponsored evaluation of the 
implementation of Section 491 of the 
Public Health Service Act and ‘‘because 
of the lack of available data about IRB 
effectiveness and how IRBs function 
operationally, many of the estimations 
in this analysis are based on anecdotal 
evidence.” This commenter stated that 
reliance on outdated and anecdotal 
“evidence” means that the NPRM 
assumptions seriously underestimate 
predictable costs, such as those derived 
from current salary data for health care 
workers who would have at least some 
background sufficient to explain 
consent, and the time needed to obtain 


consent. They also claimed that the 
NPRM analysis also seriously 
overestimates cost savings because 
excluding an activity from the Common 
Rule does not necessarily remove it 
from the purview of the IRB pursuant to 
other laws, such as the HIPAA 
regulations, and may simply shift the 
economic burden of responsible 
oversight to personnel elsewhere within 
the organization. This commenter also 
noted that the initial transition costs 
estimated in the NPRM are staggering, 
mostly due to costs related to 
biospecimen provisions. 

One commenter stated that a review 
of the tables indicates that the costs 
used for hourly wages of individuals 
affected by the proposed changes may 
be underestimated by as much as 12 to 
139 percent. Similarly, the hours 
associated with the proposed changes 
are substantially underestimated. 

One commenter stated that an 
institutional official must be 
administratively high enough to insist 
on any necessary institutional changes, 
most likely a Vice President or higher, 
and felt that such an official would 
make at least $250 per hour. This 
commenter stated that the $48.20 
estimate in the proposed rules may 
apply to liberal arts colleges, but the 
proportion of medical research 
conducted at such institutions is small 
and strongly recommends that salary 
data from medical institutions 
(published for public institutions) be 
used to generate a revised cost estimate. 
One commenter stated that the estimates 
of the salary rates presented in the 


NPRM for institutional officials, IRB 
members and staff, and investigators are 
far below the national average for these 
roles. Likewise, they state that the 
anticipated benefits of the new 
proposed rule appear to be grossly 
overstated. 

One commenter stated that the rule as 
proposed was officially estimated to add 
$1.4 billion a year to the cost of the 
current system, but the true cost 
increase will be at least triple that due 
to egregious underestimates of wage 
costs, substantial underestimates of time 
spent on red tape by investigators, and 
many underestimated or omitted costs, 
as well as some estimates that 
misrepresent the effects of the rule. 
They claim that the rule is likely to 
impose about $5 billion a year in 
needless costs, while reducing rather 
than improving protection of human 
subjects. One commenter stated that, at 
their institution, analysts average far 
greater pay levels than $15 per hour, 
and many of the tasks will have to be 
borne by faculty whose salaries exceed 
what is identified in the current cost 
analyses. 

One commenter proposed to mandate 
instead that institutions sufficiently 
resource their IRBs so as to protect 10 
percent of their IRBs’ and IRB 
administrators’ time (about 1 meeting/ 
year for an IRB that meets monthly; 
about 200 hours/year for a full-time 
equivalent IRB administrator with 2 
weeks’ vacation and 40-hour work 
weeks) to devote to finding efficiencies 
and innovations in the IRB review 
process. 
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a. Response to General Comments 


We note that the NPRM discussed the 
fact that data about IRB effectiveness 
and how IRBs function operationally 52 
is generally unavailable. The NPRM 
further noted that many of the NPRM 
RIA assumptions were based on 
anecdotal evidence; the NPRM 
requested comment on the accuracy of 
the assumptions presented and on 
whether better data sources might be 
available to support the analyses. RIA 
comments did not provide the evidence 
necessary to improve our estimates, and 
thus, limited changes have been made. 

We note that the NPRM RIA used a 


national average for the salary estimates. 


We received no compelling evidence to 
change cost estimates because we must 
account for the fact that personnel and 
salaries in affected categories vary 
widely. 


2. Extension of the Common Rule to 
Certain Nonfederally Funded Clinical 
Trials 


One commenter stated that coverage 
of this subset of projects will extend 
requirements, such as the single IRB 
requirement, without any consideration 
or mechanism for how to implement or 
fund this requirement and they do not 
believe that they should be required to 
accept added cost and burdens without 
any meaningful or measureable benefit 
to the welfare of human subjects. 

One commenter stated that the 
inclusion of nonregulated, unfunded 
trials under the regulations for the 
subset of organizations that receive 
federal grants would lead to a 
significant increase in burden, delay, 
ambiguity, and cost, and a loss of 
valuable research without increasing 
protections for human subjects. 

One commenter stated that an 
unintended burden would be the 
increased administrative costs of 
requiring reporting of all clinical trial 
Unanticipated Problems Involving Risks 
to Subjects or Others (unanticipated 
problems) to OHRP. They estimated 
requiring all unanticipated problems to 
be reported would increase their 
institution’s necessary reporting by 25 
percent. 


a. Response to Comments on Extension 
of the Common Rule to Certain 
Nonfederally Funded Clinical Trials 


The final rule does not adopt this 
proposal. 


52 See, e.g., Abbott L, Grady C. A Systematic 
Review of the Empirical Literature Evaluating IRBs: 
What We Know and What We Still Need to Learn. 
Retrieved from http://www.ncbi.nlm.nih.gov/pmc/ 
articles/PMC3235475/. 


3. Biospecimens 


With respect to expanding the 
definition of human subject to include 
nonidentifiable biospecimens and 
creating an exemption for secondary 
research on these specimens and 
identifiable information, many 
commenters claimed the NPRM 
significantly underestimated the cost of 
including nonidentified biospecimens 
under human subjects regulations and 
the consequent requirement for 
informed consent. Comments of a 
professional association, which were 
endorsed by numerous other 
commenters, stated that the NPRM has 
underestimated the financial impact of 
the Common Rule changes by a factor of 
at least 10, failing to account for the 
significant volume of specimens 
gathered outside of the federally funded 
environment, vastly underestimating the 
required time commitment and the 
requirements of administering a 
database to track consents, failing to 
include the expense incurred should an 
individual withdraw his or her consent 
for future research, and not including 
the potential expenditures required to 
develop a robust database that may be 
queried by researchers to identify 
biospecimens for use in future research 
projects. This association, and the 
numerous commenters who endorsed 
their comments, also felt that the 
increased administrative and cost 
burden to obtain informed consent for 
nonidentified biospecimens will 
disproportionately affect departments of 
pathology and laboratory medicine and 
will further increase indirect costs, 
which will eventually be built into the 
cost recovery rate from NIH, thereby 
reducing funds available for research 
when the NIH budget is fixed. One 
commenter stated that a major 
operations issue, and the one most 
necessary to ensure compliance with 
such a change, is the appropriate 
cataloging of biospecimens. Inherent in 
this new process are costs that will vary 
greatly based on the size of the stock of 
biospecimens held. Another commenter 
stated that the estimate for these costs 
was not plausible given the costs of 
developing or re-designing electronic 
systems. 


a. Response to Comments on 
Biospecimens Proposals 


As noted above in the preamble, the 
provisions relating to making 
nonidentified biospecimens subject to 
the Common Rule have been entirely 
eliminated. The final rule RIA does 
include impact estimates related to this 
proposal in Section XIX.E of this 


preamble, discussing the impact of 
regulatory alternatives considered. 


4. Broad Consent 


One commenter wrote that the NPRM 
stated that institutions would need to 
obtain broad consent from only a third 
of the 30 million individuals who are 
estimated to provide research and 
clinical biospecimens each year. 

Several commenters stated that this 
assertion fails to recognize that broad 
consent would need to be obtained from 
most individuals, not just those 
identified as research subjects, and 
underestimates the amount of time 
needed to revise consent processes and 
obtain such consent. For one institution, 
assuming staff time to obtain broad 
consent averages 20 minutes and the 
minimal staff salary is $25 per hour, this 
cost alone would be $2.54 million per 
year. Several commenters noted that the 
NPRM estimates that, per subject, the 
investigator or dedicated health care 
professional will spend 5 to 10 minutes 
obtaining broad consent, but this 
institution believes that a more 
appropriate standard for obtaining broad 
consents, particularly in the initial 
years, would be 20 to 30 minutes. One 
commenter stated that literally 
hundreds of employees would need 
extensive training and periodic 
retraining in research ethics to obtain 
broad consent, and they calculate that 
every procedure that involves any tissue 
collection should take a minimum of 10 
to 15 minutes of additional staff time to 
be able to even attempt to make the 
process meaningful. 

Many other commenters stated that 
tracking broad consent would impose 
significant costs, and require significant 
resources and infrastructure 
restructuring, given the complicated 
framework proposed by the NPRM. 

One of these commenters also stated 
that a significant cost absent from the 
NPRM analysis is the potential need for 
rebuilding existing biorepositories and 
databanks that may be invalidated 
under the NPRM because: (1) The 
samples were collected without initial 
broad consent; (2) the samples are coded 
and thus not eligible for the transition 
provisions; (3) consenting all human 
sources would not be feasible; and (4) 
the revised and limited waiver 
mechanism would not be available. One 
commenter estimated that it will require 
millions of dollars to build and support 
the necessary IT and infrastructure 
required to keep track of the consents. 
One commenter stated that, if the 
NPRM’s concern for “‘respect for 
persons”’ is really sincere, then the cost 
estimates involved should be increased 
by a factor of 4 to 10 times what is 
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estimated in the NPRM. One commenter 
stated estimates that the biospecimen 
changes alone will cost their institution 
close to half a million U.S. dollars just 
in system changes to allow for the 
added administrative consent processes 
followed by the tracking mechanisms 
that will have to be put into place to 
accommodate the regulatory changes. 


a. Response to Comments on Broad 
Consent 


As noted above in the preamble, the 
provisions relating to making 
nonidentified biospecimens subject to 
the Common Rule have been entirely 
eliminated. Eliminating that proposal 
largely addresses the concerns regarding 
costs of the Broad Consent proposal. 
Note that in response to public 
comments, we have modified our 
estimates of the time it would take to 
seek, obtain, and document broad 
consent under the regulatory 
alternatives section of the RIA. 


5. Exemptions 


One commenter stated that even ifa 
decision tool is used, IRBs will likely 
still need to review protocols to confirm 
the exempt classification, which will 
therefore not result in any cost savings. 


a. Response to Comments on 
Exemptions 


The final rule does not include the 
exemption determination and 
documentation requirement proposed in 
the NPRM. 


6. Privacy Safeguards 


One commenter stated that mandatory 
use of HIPAA or alternative, but yet-to- 
be determined, data security provisions 
would lead to a significant increase in 
burden, delay, ambiguity, and cost; this 
commenter also asserted that these 
safeguards might result in a loss of 
valuable research without increasing 
protections for human subjects. 

One commenter noted that a large 
component of the data security 
safeguards is only necessary because of 
the 10-fold increase in the number of 
identified biospecimens due to tracking 
informed consent and that this adds 
significantly to the cost of this 
requirement, well beyond what was 
represented in the NPRM RIA. 


a. Response to Comments on Privacy 
Safeguards 


The final rule does not adopt the 
NPRM’s proposal to implement 
standardized privacy safeguards. 


7. Continuing Review 


One commenter applauded the NPRM 
for recognizing the cost-benefit value of 


eliminating continuing review for many 
studies. This will have a positive impact 
on the workload of investigators and 
IRBs. 


8. Single IRB Review 


Several commenters stated that 
mandated single IRB review would not 
decrease the burden for investigators but 
would, in fact, increase the burden in 
both the long and short term. They 
stated that investigators who currently 
work only with a single IRB (their 
institution’s IRB) will now have to work 
with multiple IRBs, adding to burden. 
Further, the resources needed to use a 
commercial IRB would be beyond the 
capacity of small trials, which often 
have limited resources. One of these 
commenters estimated that, an 
investigator who has 50 protocols and 
currently two IRBs of record, would 
have a minimum of 10 different IRBs of 
record under the regulations proposed 
in the NPRM. As a result, the 
investigator would need to work with at 
least an additional 8 IRBs (10 in total), 
each with unique and complex 
requirements. 

One commenter stated that the NPRM 
grossly underestimates in its 
assumption that a central IRB 
administrator would cost $15 per hour. 

One commenter stated that 
developing the infrastructure to support 
this effort will involve significant 
financial costs. Although using single 
IRBs for multi-institutional studies has 
the potential for long-term cost savings 
and reduction of burden when 
implemented well, reaching that point 
requires a substantial initial investment. 
Many other commenters agreed that the 
NPRM underestimated these initial 
costs. They stated that these ‘‘start-up 
costs”’ include but are not limited to: 
The creation of electronic management 
systems that are interoperable among 
institutions; the adaptation of 
automated processes to multiple 
institutions; the communications tools 
necessary to link investigators and IRBs; 
the staff time necessary to develop 
agreements, consensus documents, or 
standard operating procedures; and the 
interaction necessary to build and 
maintain trusting relationships among 
institutional officials. One university 
received an estimate from the vendor of 
such a system that costs to 
accommodate this change would be in 
excess of $220,000 for the initial 
changes, with increased maintenance 
costs thereafter. In addition, the 
university would need to hire at least 
one full-time-equivalent (FTE) to handle 
the interface with all of the potential 
central IRBs and this position has a 
salary mid-point of $54,000, to which 


would be applied fringe benefits costs of 
$19,500. Several commenters noted that, 
even for institutions not serving as the 
IRB of record, there are real financial 
implications of participating in the 
centralized process in terms of adapting 
existing software systems and protocols. 

One commenter noted that the RIA 
section of the NPRM assigned nearly 
one-third of the total financial benefit of 
the revised Common Rule to savings 
achieved by the use of single IRBs for 
cooperative research. The RIA arrived at 
its estimate by assuming that when a 
single IRB of record reviews a protocol, 
all institutional costs are eliminated. 
The commenting institution uses 
numerous single IRBs, and they say they 
know from experience that the 
assumptions in the RIA are erroneous 
and no net savings accrue for IRB staff 
when using single IRBs of record. This 
same commenter noted that the NPRM 
states that its authors believe that, over 
time, standardization of agreements will 
occur so that all issues that currently 
take weeks or months to negotiate will 
be resolved. This commenter stated that 
no data to support this assumption and 
that, with each new single IRB required 
by NIH, they find a new set of 
requirements that requires the 
negotiation of hundreds of agreements 
with other institutions. They believe 
that study initiation will often be 
delayed because of this requirement and 
will result in additional software system 
needs and costs that are not even 
contemplated in the NPRM. They also 
stated that the vast majority of research- 
intensive universities are already over 
the federal mandated 26 percent 
facilities and administrative cap. 
Therefore, the commenter noted, the 
universities have no mechanism for 
funding the additional costs of serving 
as a central IRB because IRB costs are 
included in the portion of the facilities 
and administrative costs. 

One commenter estimated the costs of 
ensuring an appropriate data flow 
between an institution and each new 
IRB of record, with respect to research 
studies conducted, to require an extra 
200 hours of IRB administrator time, in 
addition to software customization, 
configuration, and development costs. 
This commenter estimated the true costs 
far exceed those included in the NPRM 
by a factor of 1433 percent (2150 hours 
required in total for 10 IRBs of record, 
versus 150 hours). Even splitting the 
difference to only a factor of 767 percent 
(1150 hours required in total for 10 IRBs 
of record versus 150 hours), the true 
costs of this approach virtually eclipse 
any possible quantified benefits 
estimated in the NPRM. 
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Two commenters cautioned that the 
costs to implement single IRB review in 
multi-institutional studies should not be 
factored into the overall cost breakdown 
of a contract or grant. In other words, 
federal departments and agencies 
supporting research should make 
additional funds available to cover the 
costs associated with implementing 
§ 114. 


a. Response to Comments on Single IRB 
Review 


We agree with commenters who felt 
that mandated single IRB review will 
ultimately decrease administrative 
burdens and inefficiencies for 
investigators and institutions, while 
acknowledging that the transition to this 
model will require time and an 
adjustment to institutional structures 
and policies. To incorporate this into 
our estimates, we assume that 
investigators for which multi- 
institutional reviews are eliminated will 
face a reduction in burden associated 
with the elimination of the site-specific 
protocol review, but will face increased 
burden in the form of coordination with 
investigators at other sites, for example 
to ensure that the results of the IRB 
review are effectively communicated. 
Specifically, we assume that the 
elimination of multi-institutional 
reviews will result in investigators 
spending half as much time engaging 
with the review process as they would 
have if IRB review had taken place at all 
sites. As a result, the estimated 
quantified benefits associated with the 
elimination of multi-institutional review 
have been revised downward by 27 
percent. 


9. Posting of Clinical Trial Informed 
Consent Forms 


Several commenters stated that they 
do not see the utility of the proposed 
provision to publish consent forms to a 
public Web site as it creates a new 
administrative burden without 
providing any clear additional 
protection for research subjects or 
benefit to the public at large. One 
commenter stated that the cost estimates 
that the NPRM attaches to this proposed 
requirement are unrealistically low. One 
commenter stated that if the site is 
either ClinicalTrials.gov or some future 
site that is of equal difficulty to use, the 
cost estimates for investigators and 
institutions to upload to the site are 
greatly underestimated. This institution 
has found that their investigators have 
found ClinicalTrials.gov sufficiently 
difficult that they have had to add and 
train staff devoted solely to meet this 
requirement. 


a. Response to Comments on Posting of 
Consent Forms 


We note that this change, compared to 
the huge costs of clinical trials, will add 
a relatively small amount of additional 
burden. The time by which a consent 
form must be posted has been greatly 
extended. Furthermore, provisions have 
been added that allow for redaction of 
certain portions of consent forms, 
including the entire form in appropriate 
instances. We estimate that the revised 
rule will not affect the quantified and 
nonquantified costs summarized in the 
NPRM. 


D. Analysis of Benefits and Costs 


In this section, we present the 
analysis of the quantified and 
nonquantified benefits and costs of the 
changes to the Common Rule. First, we 
discuss the common assumptions of the 
analysis. Then we present the estimated 
quantified and nonquantified benefits 
and costs of the specific changes. As 
discussed above and in the NPRM, 
because of the lack of available data 
about IRB effectiveness and how IRBs 
function operationally, many of the 
estimations in this analysis are based on 
anecdotal evidence. 


1. Analytic Assumptions 


The analysis relies on common data 
elements and assumptions, detailed 
below, concerning the domestic entities, 
individuals, and IRB reviews affected by 
the changes to the Common Rule. Many 
of the estimates are derived from a 1998 
NIH-sponsored evaluation of the 
implementation of Section 491 of the 
Public Health Service Act, which 
involved nationally representative 
surveys of IRBs, institutions, and 
investigators. Based on a review of the 
literature, this study contains the best 
available data on the time spent on 
protocol reviews as well as the 
characteristics of the reviews 
themselves. Additionally, OHRP 
processes the majority of FWAs and IRB 
registrations for all Common Rule 
departments or agencies. Thus, using 
information from the OHRP database of 
assured institutions and registered 
institutions or organizations and their 
IRBs is a reasonable way to estimate the 
number of institutions and IRBs 
regulated by all Common Rule 
departments or agencies that will be 
affected by these changes. OHRP’s IRB 
registration process requires institutions 
and organizations to provide 
information about the approximate 
number of active protocols reviewed by 
IRBs during the preceding 12 months. 
Thus, OHRP’s IRB database is the best 
source for determining the total number 


of protocols reviewed by IRBs at this 
time. 

According to the OHRP database of 
assured institutions and registered 
institutions or organizations and their 
IRBs, approximately 8,035 institutions 
in the United States have an FWA, of 
which 2,871 have an IRB. Some 
institutions have multiple IRBs and 
some IRBs are not affiliated with an 
institution with an FWA. In total, 3,499 
registered IRBs are in the United States. 

The OHRP database of assured 
institutions and registered institutions 
or organizations and their IRBs shows 
that 675,390 annual reviews of 
nonexempt protocols involving human 
subjects are conducted. It is estimated 
that of this total, 324,187 are initial 
protocol reviews (48 percent) and 
351,203 are continuing protocol reviews 
(52 percent) based on estimates reported 
in Bell et al.53 In each category, it is 
estimated that 69 percent of these 
reviews are convened and 31 percent 
are expedited based on estimates 
reported in Bell et al. 

It is estimated that 472,773 reviews of 
single-site protocols (70 percent) and 
202,617 reviews of multi-institutional 
protocols (30 percent) take place, based 
on estimates reported in Bell et al. This 
analysis also assumes that, on average, 
5 IRB reviews take place per multiple- 
site protocol. This implies 472,773 
single-site protocols and 40,523 multi- 
institutional protocols, for a total of 
513,296 protocols. The above also 
implies approximately 246,382 new 
protocols each year. 

Based on queries of ClinicalTrials.gov, 
we estimated that HHS supports 909 
new clinical trials annually, of which 
575 are regulated by FDA. In addition, 
based on queries of ClinicalTrials.gov, 
non-HHS Common Rule departments 
and agencies support approximately 
5,270 studies. 

Many individuals in various 
occupations would be affected by the 
changes to the Common Rule. We 
estimated that an average of one 
institution official at each institution 
with an FWA would be affected by these 
changes, for a total of 2,871 institution 
officials. The OHRP database of 
registered IRBs shows that IRBs have 
10,197 full-time equivalents (FTEs) staff 
persons working as administrators or 
administrative staff, and that 89.8 
percent of IRBs have an administrator. 
It is assumed that these individuals 
work full-time, implying a total of 3,193 
IRB administrators and 7,004 IRB 


53 Bell J., Whiton J., and Connelly S., Final 
Report: Evaluation of NIH Implementation of 
Section 491 of the Public Health Service Act, 
Mandating a Program of Protection for Research 
Subjects, 1998. 
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administrative staff. The OHRP database 
of IRB membership rosters contains 
3,359 individuals who serve as IRB 
chairs and an additional 32,518 voting 
members. The number of IRB chairs is 
less than the number of IRBs because 
some individuals chair multiple IRBs. It 
is assumed that 439,968 investigators 
conduct human subjects research in the 
United States.54 

We estimated the hourly wages of 
individuals affected by the changes to 
the Common Rule using information on 
annual salaries provided by the U.S. 
Bureau of Labor Statistics and the U.S. 
Office of Personal Management. The 
salary of postsecondary education 
administrators is used as a proxy for the 
salary of institution officials; the salary 
of lawyers is used as a proxy for the 
salary of institution legal staff and IRB 
administrators; the salary of office and 
administrative support workers is used 
as a proxy for the salary of IRB 
administrative staff; the salary of 
postsecondary health teachers is used as 


a proxy for the salary of IRB chairs and 
IRB voting members; the salary of 
postsecondary teachers is used as a 
proxy for the salary of investigators; the 
salary of database and systems 
administrators and network architects is 
used as a proxy for the salary of 
database administrators; and the salary 
of all occupations, as a proxy for the 
salary of prospective human subjects. 
The federal employees affected by the 
changes to the Common Rule are 
assumed to be Step 5 within their GS- 
level and earn locality pay for the 
District of Columbia, Baltimore, and 
Northern Virginia. Annual salaries are 
divided by 2,087 hours to derive hourly 
wages. To project wages over 2017— 
2026, wages are adjusted for growth 
over time using the average annual per 
capita growth in real wage income over 
1929-2012 reported by the U.S. Bureau 
of Economic Analysis, which is 2.1 
percent. The total dollar value of labor, 
which includes wages, benefits, and 


overhead, is assumed to be equal to 200 
percent of the wage rate. 

We calculated person-hours by 
occupation per initial protocol review 
and per continuing protocol review 
based on each occupation’s share of 
total person-hours reported in Bell et al. 
In particular, Bell et al. reports that 
institution officials account for 4 
percent, IRB administrators account for 
28 percent, IRB administrative staff 
account for 30 percent, IRB chairs 
account for 7 percent, and IRB voting 
members account for 31 percent of total 
person-hours. We assumed that the 
average number of person-hours spent 
per review equals the weighted average 
of the person-hours spent per convened 
review and the person-hours spent per 
expedited review. We further assumed 
that convened review requires twice as 
many person-hours as expedited review. 

Table 3 shows the number of entities 
affected by the changes to the Common 
Rule and other common assumptions of 
the analysis (described above). 


TABLE 3—NUMBER OF AFFECTED ENTITIES AND OTHER COMMON ASSUMPTIONS 

































Description Estimate 
U.S. Institutions and IRBs: 
Institutions With AN FWA uuu... cece eee cee e cess eeae cease cease eeeseaeeceeecaeeseeeseaeeseaescaeeseaeeeeeseaeeseeseaeesseesseeseeaseeeseaeeeeesaes 8,035 
FWA Institutions with an IRB .. 2,871 
FWA Institutions without an IRB sat 5,164 
WISER BS is 2 artcom:.. gee set sore cnn weed seen ter times 25. nec steel aces acone, cies nud ssecohens naka see bens a umede net amen bea 3,499 
Occupations: 
INSTITUTION SOPICIAIS: aisciccsced as fciteecs ich Sas S Padi es sacs lac nc Wea Ses occ s va T Us data Stand ea i da Tas de da aden aed sd added eased a 2,871 
IRB administrators ............ 3,193 
IRB administrative staff .... 7,004 
IRB chairs oe 3,359 
IRB voting members ...... 32,518 
TaN Cees (Te F=l Co] go searenneperr rece peer ee crrerct ee PrcEPT eer PrerTreeereccree ce eerereeerrerr Pee eereerrrecePecrreecreserreecrPer TrecrrererrreceecrTrerrreerireer rere Ceerr reer etree 439,968 
Hourly Wages: 
Institution: officials (2015), :..nt.c2ni a Ce ete ee eee ee ee $49.17 
Institution legal staff (2015) .. $65.29 
IRB administrators (2015) .......... $65.29 
IRB administrative staff (2015) ... $17.41 
IRB chairs (2015) ......cccceeeeeees $50.06 
IRB voting members (2015) . $50.06 
Investigators (2015) 0... eee $37.13 
Database administrators (2015) ....... $40.37 
Prospective Human Subjects (2015) .......ecseceesesseeceeseeeeeeeeeeeeaeceeeeaeeeeeeeseeseeseeeeesareneeeaes $23.15 
Federal employees in the District of Columbia, Baltimore, and Northern Virginia (2015) 0... ceeeeeeeeseeeeereeseeeeeeseee | ceneeeeeeeeeeeeeeeeeaeeeeeeeneeaes 
GS-11 Step wiccisi hn watered islivnei een navi ea clviedeeets $34.60 
GS-13 Step 5 ... $49.32 
GS-14 Step 5 ... $58.28 
GS-15 Step 5 ... $68.56 
Average annual per capita growth in real Wage INCOME uo... ee cece eect e eee e eee eeeee seas eeeeeseaeeseaeseaeessaeeseeseaeesseeseaeeeeeees 2.1% 
IRB Reviews of Human Subjects Research Protocols at U.S. Institutions: 
Annual reviews of nonexempt protocols oo... eee e ee eeeeeeeeee sees seas eeeeeeeeseaesceeeseaeeseeeseaeesaeseaeeseeessaeeseaeesseeseaeseaees 675,390 
Initial protocol reviews (48%) .......... 324,187 
Convened reviews (69%) ... 223,689 
Expedited reviews (31%) ... 100,498 
Continuing protocol reviews (52%) 351,203 
Convened reviews (69%) ... 242,30 
Expedited reviews (31%) ......ee 108,873 
Annual reviews of single-site protocols (70%) o...eeeeeecceeeeeeeceneeceeeeeeeeeeceeesenesceeeseaeeeeeeseaeeseeseaeeseeeseaeeseaeesseesseeeeees 472,773 


54To derive this estimate, the number of new 
protocols, estimated above, is divided by the 
average number of new protocol submissions 
reported per investigator. This is estimated to be 2.8 


based on Bell et al. This number is then multiplied 
by the average number of investigators working on 
each protocol (which is assumed to be 5). This 
allows for an accounting of investigators working 


on multiple protocols as well as protocols with 
multiple investigators. 
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TABLE 3—NUMBER OF AFFECTED ENTITIES AND OTHER COMMON ASSUMPTIONS—Continued 














Description Estimate 
Annual reviews of multi-institutional protocols (30%) oo. .ee eee cee eee eeeneeeeee eee eceeseaeeseeseaeessaeseaeeseeeeseeseaeesseesnaeeeeeees 202,617 
Human Subjects Research Protocols at U.S. Institutions: 

AClIVE-PIOLOCOIS scar; (cate vacate cae. nec ret to 28a aad tet 2 cee ceca se can dente oict denned person ou ooh hased put sxeeseai at vevver sGutai nd ateeve nae ueiopiat eae 513,296 
Single-Site ProtoCOls sss. sie. eesivee sess vadecsyaresneaswess caeiten poche esudeven utes dobivas cctueytiteevonaysanoctineonddea atenuy a ecteeyteeoavenea sd: 472,773 
Multi-site protocols .... 40,523 

New protocols (48%) ....eeeeceeseeteeseceeeeneeeeeeeeeeeeeeseeeeeesaeeeeeseeeeesaeeneseaten ae 246,382 

Average number of IRB reviews per active multi-institutional ProtoCol o.oo... eee eee eee eeee cess eee eeaeeseaeeeseeeeaeenaees 5 

Clinical Trials: 

New clinical trials supported by HHS annually 0... eeceeseseeeeeeeeeeeseeeeeeeeeeeeeesesaeeeesaeeeaesaeeeeesaeeeeesaeseeesaeseeesaeseeeeeeaeees 909 
Regulated by FDA ....... eee eeeeeee eens eeeeeee 575 

Clinical Trials supported by Common Rule Agencies ...........:ccesceeceeseseseeeeeeeeeseeeeeeeeeaesenesaesaeeeaeeaeseaeeaeeneesaesneeeaeeneeeaeeeees 5,270 

Person-Hours per Protocol Reviewed by Occupation and Type of Review: 
Institution officials: 
Initial protocol reviews: 
Gonvened: TeViOWS jcc i cee cae. cceeieeiae ei nseeiyesetone aiden Ga keniaeiergteeauaar tient aig eu eerie erates 0.52 
Expedited reviwsi 25sec Say stica dads seve dh cvdac testes vetcvvsevveveuecvsticuuvebescarsdeedsbevavisweres sabes eres seveieers aueeee peeved seneetanneevent 0.26 
Continuing protocol reviews: 
Gonivened reVieWS «fcr ves ec aces ar ee yea te eee ea erp atid a dee 0.10 
EXPOCILECTOVIOWS Severs: pete caste exadevacoehice Givenedesdeeoreeiceaventarteronepadadeihenedctchedenisrd sdoeasdrheattevnesarieduea tu coadesrsnts crantend 0.05 
IRB administrators: 
Initial protocol reviews: 
COnvened reViCWS .........esceccesceeceeeecseesseeeeeaeeseeaeeseeaesseeaecseeeaeeaecsaesseesaecsecsaesseseaasaessceeaeseaeeaesseseaesaeesaeeeeeeateaes 3.64 
Expedited rEViOWS iis vescectsenuespduanieeccatecedihsueus ere sciicstiehssnuik sussdgace cruuenoslesbitedneutaacabdeaeel dattdvedtdancuelbeseutcenousbeede 1.82 
Continuing protocol reviews: 
Gonvened 'eVIOWS: .cc.catacecat nines nee neteenteat vies ieae ane ie natiena taba hentai nbteiaea tas 0.68 
EXPedited TOVIOWS ue fisistcecdss, catsentcouduecedets sree crey sods sucebsteudvasussddadecesurhoscesheteddeesdupcabstacstdattdeetedcanddebodeutcestnushesks 0.34 
IRB administrative staff: 
Initial protocol reviews: 
ConVened eviews). 26.4ciaian hide diaa daisies od paki aia ied Ste tenr aie oto aniseed 3.91 
EXPeOGiteGireVIOWS§ .sc.ohvzsSaecdcararsuccusstconieddeene sues GnrasuhisscrasuvessoxvannediG ce dasekodenascevancuseilueasiihetexeddunads deduesnedyneadieya: 1.95 
Continuing protocol reviews: 
Convened reviews *.. 4 asi. tatannihis cilia Atte eeeieesc dit tie Sear kee Bia ent 0.73 
Expedited TeViOWS ss ississrcceschegredaneusutcedecesscvessevostanste skeen dingarcusedee bacicaochevotiteccbaevncavetressaaiceva dts cascusdavennruecescatent 0.36 
IRB chairs: 
Initial protocol reviews: 
Convened reviewS).:..a2.ccrk cial et ae ee teed re ee Satie ee ee 0.91 
Expedited neviOwS: tetaiscccesctscscativtees aici covesdes ea ediadesey severees Rites ced a sete oan oteeca tevin avitis ate eraindersesd Bo veeseT re eGT 0.46 
Continuing protocol reviews: 
Gonveried 16VieWS 23... eviene ek eee sk ak cee a ee 0.17 
Expedited :revidWS?atasaivitnitlai cenit iste dediiin atid atid caitiieneteicanseaninntr een nieentndeteiivelied 0.08 
IRB voting members: 
Initial protocol reviews: 
COnvened FeViCWS ou... eeeecceeceeseeneeeeeeeeeeeaeeaeeeaeeaeesaesaeeeaecseeeaecaeseaecaeeeaeeaeseesaeseaesaeseeeeaeseeesaeeeeeeaeeneesaeeneeeateaes 2.70 
Expedited eviews \jccccisseeecvecscarecsciessecceteusspevedtentenven dens ceveatevedepechdes'caceadvsedevecav sai cusisaPesatesedps cnedateveepecesedeeceous eens 1.35 
EXOMPtFOVICWS fcc. i isecseheveravevediveges Sevdinneeted nievssbesGeea teed drestbevtasdieed neteu sedis bes tnrsines eal reen 0.50 
Continuing protocol reviews: 
Gonvened TeVIOWSrcccrri cece. ctenet ee eernye serine etc ener elatian adie aie een teeeeeeniaae: 0.75 
Expedited revigws vied: escciscevericotedl vedee Sievsacteetes seicvssesneseusscvetecueebevecysurecevevevecess eu aben eres sevtivens ayeydepeedeapersenaniaeient 0.38 
Investigators: 
Initial protocol reviews: 
GONVEMECTOVIOWS . cscccuisccsccsteeczesunstiviesdazternectsscersuendeateesdvelesuesuresashvocesttnecssesdteeresaepesadeseassuctestushinadbonartiseseas’ 13.65 
Expedited TeViOWS: vicccicrccescvssecueessieeteccotevesuveuesecteccuccusseveurecesdvachevsscvedeevoudivactesencaschwssedtusdveshecatenedeoesutiveceeteceas 7.15 
EXEMBt TOVIOWS ov ctarceeseesesetscaceccendes vase ca sdeten esteusiey sasauvarvauncusees cedessidssnaroudesvtaceastuvinnsvavedseseindvsbenbebesevesuseevee deed 0.50 
Continuing protocol reviews: 
Gonveried 1eviews sis. cniecsdis ce uetececd beelh i dieganedy titiots dace uae tent re an de ee 6.83 
Expedited :tevieWSo-ticcrscieveteestacer eink anise eirid aeeitrvaatensesds a iereisins tote siaas oeuvre ens nahi nave: 3.58 








2. Analysis of Changes 


We present below an analysis of the 
quantified and nonquantified benefits 
and costs of the changes to the Common 
Rule. For each change, we describe the 
change, provide a qualitative summary 
of the anticipated benefits and costs, 
describe the methods we use to quantify 
benefits and costs, and then present 
estimates. 


a. Costs for the Regulated Community 
To Learn New Requirements and 
Develop Training Materials; Costs for 
OHRP To Develop Materials and 
Guidance 


Domestic institutions, IRBs, and 
investigators would need to spend time 
learning the changes to the Common 
Rule once training materials become 
available to them. In addition, IRBs and 
OHRP would need to update training 


materials for investigators. OHRP also 
would need to develop guidance, 
templates, and a number of electronic 
resources. 


We estimate that institution officials, 
IRB administrators, IRB administrative 
staff, IRB chairs, IRB voting members, 
and investigators would each spend 5 
hours to learn the changes to the 
Common Rule. We also estimate that 
institution officials would spend 2 
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hours to learn new procedures, IRB 
administrators would spend 20 hours, 
and administrative staff would spend 80 
hours. Based on the estimates presented 
in Table 3, the dollar value of their time 
is calculated by multiplying hours by 
their estimated 2016 wages and 
adjusting for overhead and benefits. For 
example, to calculate the dollar value of 
time spent by institution officials to 
learn the changes to the Common Rule 
in 2017, we multiply the number of 
institution officials (2,871) by the 
number of hours spent per institutional 
official (5), by the projected hourly wage 
of institution officials ($49.17), and by 
the adjustment factor for benefits and 
overhead (2). 

In order to develop the resources 
required by the final rule, we anticipate 
that OHRP would need: 

e Three staff people at the GS—14 
level and three staff people at the GS— 
13 level to: (1) Promote harmonization 
efforts to issue guidance across Common 
Rule agencies and departments; (2) 
develop guidance for the regulated 
community; (3) develop template 


agreements for use by the regulated 
community; (4) manage the 
administrative transition to the new 
processes in the final rule; and, (5) 
develop web-based posting portals. 

e One staff person at the GS-13 level 
to manage process changes in the final 
rule, and assist with implementation for 
the web-based portals. 

e One staff person at the GS-11 level 
to provide technical support for the 
web-based portals in the final rule. 

In addition, the first year after the 
final rule is published staffing resources 
beyond what is described above would 
be necessary: 

e Three staff people at the GS-14 
level to draft new guidance and revise 
old guidance. 

e One staff person at the GS-14 level 
to conduct educational seminars. 

OHRP also anticipates the following 
in nonpersonnel costs: 

e Technical development of two Web- 
based portals for investigators to post 
final consent forms for HHS-funded 
clinical trials, and for investigators who 
conduct certain types of demonstration 


projects to post information about said 
projects ($350,000) 

e Developing five educational 
seminars (including travel) to educate 
the public about the requirements of the 
new rule ($150,000) 

e Upgrading equipment for education 
activities ($50,000) 


We also note that additional staff time 
throughout the Common Rule 
departments and agencies will be 
needed to fulfill the consultation 
requirement foundin§ _.102(e)(7). 
As we assume that this consultation will 
not involve the hiring of additional 
personnel to fulfill, we consider this a 
nonquantified cost. 

Present value costs of $214 million 
and annualized costs of $25.0 million 
are estimated using a 3 percent discount 
rate; present value costs of $204 million 
and annualized costs of $29.1 million 
are estimated using a 7 percent discount 
rate. Table 4 summarizes the quantified 
and nonquantified benefits and costs to 
learn new requirements and develop 
training materials. 


TABLE 4—SUMMARY OF ESTIMATED BENEFITS AND COSTS TO LEARN NEW REQUIREMENTS AND DEVELOP TRAINING 















































MATERIALS 
Present value of 10 Annualized value over 10 
years by discount rate years by discount rate 
(millions of 2015 dollars) (millions of 2015 dollars) 
3 percent 7 percent 3 percent 7 percent 
BENEFITS: 
Quantified Benefits: 
NONG eee ciotisvecbieies terre iineserte avivensiani tients erase da nrneel) aetacndceitin® | Cieiaraiiaaiy | Uaiiiaiainie es) aida adineie 
Nonquantified Benefits: 
None. 
COSTS: 
Quantified Costs: 
Time and money to learn new requirements, update training materials, 
develop tools and conduct consultations 0.0... eeeeeeeeeeeees 214 204 25.0 29.1 
Nonquantified Costs: 
Implementation of consultation requirements. 
b. Extending Oversight to IRBs requirements at § .114. Here, we of this rule. It is further estimated that 


Unaffiliated With an Institution Holding 
an FWA (§ .101(a)) 


As outlined in the NPRM, and as 
generally supported by public 
commenters, the final rule includes a 
new provision at§ _.101(a) that gives 
Common Rule departments and 
agencies the authority to enforce 
compliance directly against IRBs that 
are not operated by an assured 
institution. We anticipate that this 
change will encourage institutions to 
rely on IRBs not operated by an FWA- 
holding institution more often and also 
will assist in the implementation of the 


estimate the impact that this proposal 
will have on IRBs that are not operated 
by an FWA- holding institution. The 
estimated impact of this and other 
related proposals on FWA- holding 
institutions is addressed in Section 
XIX.D.2.f of this RIA. 


The OHRP database of assured 
institutions and registered IRBs shows 
that approximately 449 IRBs not 
affiliated with an institution holding an 
FWA will now be subject to oversight. 
These IRBs will develop an estimated 
average of 10 written agreements with 
other institutions each year as a result 


each agreement will require an average 
of 10 hours of institution legal staff time 
and 5 hours of IRB administrator time 
to complete. 

The estimated costs to institution 
officials, IRB administrators, IRB 
administrative staff, IRB chairs, IRB 
voting members, and investigators of 
conducting these reviews are based on 
the estimates presented in Table 3. The 
dollar value of their time is calculated 
by multiplying hours by their estimated 
2017-2026 wages and adjusting for 
overhead and benefits. 

Present value costs of $85.6 million 
and annualized costs of $10.0 million 
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are estimated using a 3 percent discount 
rate; present value costs of $70.0 million 
and annualized costs of $10.0 million 


are estimated using a 7 percent discount 
rate. Table 5 summarizes the quantified 
and nonquantified benefits and costs of 


extending oversight to IRBs unaffiliated 
with an institution holding an FWA. 


TABLE 5—SUMMARY OF ESTIMATED BENEFITS AND COSTS OF EXTENDING OVERSIGHT TO IRBS UNAFFILIATED WITH AN 
INSTITUTION HOLDING AN FWA (§ .101(a)) 









































Present value of 10 Annualized value over 10 
years by discount rate years by discount rate 
(millions of 2015 dollars) (millions of 2015 dollars) 
3 percent 7 percent 3 percent 7 percent 
BENEFITS: 
Quantified Benefits: 
NON -eebecdeccvestecescinest cdvccrestecsucneusecdecedacaysacelsesdaneudechsaneesteenebenieaventettenmterde, | einvescundssceverreaven.. |) opteaviedseaeaneaconcred..| lecroecvestevesyencavedee. [ee chWeupeiabteueveed’ 
Nonquantified Benefits: 
Encouraging institutions to rely on single IRBs of record in multi-institutional studies when appropriate. 
COSTS: 
Quantified Costs: 
Developing IRB authorization agreements or other procedures .............. 85.6 70.0 10.0 10.0 





Nonquantified Costs: 
None. 





c. Explicit Carve-Outs of Activities From 
the Definition of Research (§ .102(1)) 


The final rule includes four categories 
that are explicitly deemed to be not 
research (final rule at§ —_—«.102(I)(1)- 
(4)). These categories include: (1) 
Scholarly and journalistic activities 
(e.g., oral history, journalism, biography, 
literary criticism, legal research and 
historical scholarship), including the 
collection and use of information that 
focuses directly on the specific 
individuals about whom the 
information is collected; (2) certain 
public health surveillance activities; (3) 
certain collection and analysis activities 
conducted by a criminal justice agency; 
and (4) certain activities conducted by 
a defense, national security, or 
homeland security authority. 

Institutions, investigators, and IRBs 
involved in supporting, conducting, or 


reviewing these activities will no longer 
incur the costs of IRB review and 
approval and continuing review. 
Activities that were not intended to be 
subject to the regulations will clearly be 
removed from the definition of research, 
allowing such activities to proceed 
without delays caused by the need for 
IRB submission, review, and approval. 
We estimate that 3,376 annual 
reviews of protocols (0.5 percent) will 
no longer be conducted as a result of the 
activities deemed not to be research in 
§ _.102(1)(1)-(4). Of these reviews, 
1,118 will have undergone convened 
initial review, 502 will have undergone 
expedited initial review, 1,212 will have 
undergone convened continuing review, 
and 544 will have undergone expedited 
continuing review based on the 
distribution of reviews presented in 
Table 3. 


The estimated costs to institution 
officials, IRB administrators, IRB 
administrative staff, IRB chairs, IRB 
voting members, and investigators of 
conducting these reviews are based on 
the estimates presented in Table 3. The 
dollar value of their time is calculated 
by multiplying hours by their estimated 
2017-2026 wages and adjusting for 
overhead and benefits. 


Present value benefits of $36.2 million 
and annualized benefits of $4.24 million 
are estimated using a 3 percent discount 
rate, and present value benefits of $29.6 
million and annualized benefits of $4.22 
million are estimated using a 7 percent 
discount rate. Table 6 summarizes the 
quantified and nonquantified benefits 
and costs of excluding these activities 
from the requirements of the Common 
Rule. 


TABLE 6—SUMMARY OF ESTIMATED BENEFITS AND COSTS OF § .102(1) 





Present value of 10 
years by discount rate 
(millions of 2015 dollars) 


Annualized value over 10 
years by discount rate 
(millions of 2015 dollars) 








3 percent 7 percent 3 percent 7 percent 
BENEFITS: 
Quantified Benefits: 
Reduction in number of reVieWS 0.0.0... ee eee eee eee eeeeeeeeeseaeeeeeteaeeeeeeed 36.2 29.6 4.24 4.22 

















Nonquantified Benefits: 


Increased clarity in what must be reviewed; ability for IRBs to focus efforts on reviews of higher-risk, more complex research activities. 





COSTS: 
Quantified Costs: 
None 

















Nonquantified Costs: 
None. 
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d. Clarifying and Harmonizing 
Regulatory Requirements and Agency 
Guidance (§ .101(j)) 


The final rule at § ——_—.101(j) requires 
consultation among the Common Rule 
departments and agencies for the 
purpose of harmonization of guidance 
(to the extent appropriate) before federal 
guidance on the Common Rule is 


issued, unless such consultation is not 
feasible. 


As this change likely will not affect 
staffing requirements in the Federal 
Government, no costs are quantified 
here. It is possible however, that the 
harmonization requirement could result 
in it taking longer for Common Rule 
department or agency guidance to be 


approved and issued to the public. 
Similarly, as the extent to which this 
change will reduce the time IRBs spend 
on reviewing protocols is unclear, 
benefits are also not quantified. Table 7 
summarizes the nonquantified benefits 
and costs of clarifying and harmonizing 
regulatory requirements and agency 
guidance. 


TABLE 7—SUMMARY OF ESTIMATED BENEFITS AND COSTS OF CLARIFYING AND HARMONIZING REGULATORY 
REQUIREMENTS AND AGENCY GUIDANCE (§ .101(j)) 





Present value of 10 
years by discount rate 
(millions of 2015 dollars) 


Annualized value over 10 
years by discount rate 
(millions of 2015 dollars) 





3 percent 


7 percent 3 percent 7 percent 





BENEFITS: 
Quantified Benefits: 
None 

















Nonquantified Benefits: 


Increased uniformity in regulatory requirements among Common Rule agencies; increased clarity to the regulated community about how 


regulations should be interpreted. 





COSTS: 
Quantified Costs: 
None 

















Nonquantified Costs: 


Time for consultation among Common Rule agencies before federal guidance is issued. 





e. Modifying the Assurance 
Requirements (§ .103) 


The final rule modifies the 
requirements of the assurance process in 
the following ways. First, the final rule 
does not include the pre-2018 
requirement of identifying a statement 
of principles governing all research at 
an institution. The requirement for 
institutions to designate a set of ethical 
principles by which that institution will 
abide in all research activities was 
generally not enforced. Further, for 
international institutions that received 
U.S. Government funding for research 
activities, it created the impression that 
these international institutions must 
modify their internal procedures to 
comport with the set of principles 
designated on the FWA for activities 
conducted at those institutions that 
received no U.S. Government funding. 
This provision was deleted from the 
final rule to provide clarity to these 
international institutions that such 
measures are not required for activities 
that receive no Common Rule 
department or agency support. 

The requirement in the pre-2018 rule 
that a written assurance include a list of 
IRB members for each IRB designated 
under the assurance has been moved to 


§ _.108(a)(2) and modified. The final 
rule requires that an institution, or 
when appropriate the IRB, prepare and 
maintain a current detailed list of the 
IRB members with information 
sufficient to describe each member’s 
chief anticipated contributions to IRB 
deliberation, and any employment or 
other relationship between each 
member and the institution. The final 
rule also deletes the pre-2018 
requirement that changes in IRB 
membership be reported to the 
department or agency head, or to OHRP 
when the existence of an HHS-approved 
assurance is accepted. 

The changes to the IRB roster 
requirement are expected to reduce 
administrative burden without having 
any significant impact on the protection 
of human subjects: 

Finally, the requirement in the pre- 
2018 rule that a department or agency 
head’s evaluation of an assurance take 
certain factors into consideration has 
been deleted. These factors include the 
adequacy of the proposed IRB in light of 
the anticipated scope of the institution’s 
activities and the types of subject 
populations likely to be involved, the 
appropriateness of the proposed initial 
and continuing review procedures in 


light of the probable risks, and the size 
and complexity of the institution. 
Deletion of that provision eliminates an 
administrative process that was no 
longer meaningful given the purpose 
and design of the FWA and OHRP’s 
processes for reviewing IRB registrations 
and reviewing and approving FWAs. 
This change also harmonizes the 
Common Rule with FDA’s human 
subjects protection regulations by 
eliminating the requirement to submit 
IRB membership lists. 

We estimate that administrative staff 
at each IRB would spend 5 fewer hours 
complying with the assurance 
requirements. Based on the estimates 
presented in Table 3, the dollar value of 
their time is calculated by multiplying 
hours by their estimated 2017-2026 
wages and adjusting for overhead and 
benefits. 

Present value benefits of $5.93 million 
and annualized benefits of $0.69 million 
are estimated using a 3 percent discount 
rate; present value benefits of $4.18 
million and annualized benefits of $0.60 
million are estimated using a 7 percent 
discount rate. Table 8 summarizes the 
quantified and nonquantified benefits 
and costs of the proposed change to the 
IRB roster requirement. 
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TABLE 8—SUMMARY OF ESTIMATED BENEFITS AND COSTS OF CHANGES TO MODIFYING THE ASSURANCE REQUIREMENTS 
(PRE-2018 RULE AT § .103(b)(1), (b)(3), (d)) 





Present value of 10 
years by discount rate 
(millions of 2015 dollars) 


Annualized value over 10 
years by discount rate 
(millions of 2015 dollars) 




















3 percent 7 percent 3 percent 7 percent 
BENEFITS: 
Quantified Benefits: 
Reduction in time for IRB administrative staff and OHRP staff to sub- 
mit, review, and process IRB membership lists ............:::cceeeeeeeeeee 5.93 4.18 0.69 0.60 





Nonquantified Benefits: 


Reduction in volume of records created by an institution. 





COSTS: 
Quantified Costs: 


NONG@? eiivcisees teas eeteintees sa daceteveheademenrntes 

















Nonquantified Costs: 
None. 





f. Requirement for Documenting 
Reliance on IRBs Not Operated by the 
FWA-Holding Institution (§§ __—.103(e) 
and __.115(a)(9)) 


The final rule contains a requirement 
at§ _.103(e) that, to ensure 
compliance with the requirements of the 
Common Rule, nonexempt human 
subjects research subject to this policy 
that takes place at an institution in 
which IRB oversight is conducted by an 
IRB that is not operated by the 
institution, the institution and the 
organization operating the IRB shall 
document the institution’s reliance on 
the IRB for oversight of the research and 
the responsibilities that each entity will 
undertake. This requirement could be 
satisfied, for example, by: (1) 
Developing a written agreement 
between the institution and the IRB; (2) 
implementing an institution-wide 
policy directive providing the allocation 
of responsibilities between the 
institution and an IRB that is not 
affiliated with the institution; or (3) 


describing the allocation of 
responsibilities in a research protocol. 
In addition, a requirement is added at 
§ _.115(a)(9) of the final rule that 
institutions or IRBs retain this written 
agreement or other procedures 
undertaken to ensure compliance with 
the requirements of this policy, as 
described in § .103(e). 

Initially, costs would be involved in 
drafting, revising, and conducting 
managerial review of agreements to 
ensure they satisfy these new 
requirements. Anticipated benefits 
include greater reliance on IRBs not 
operated by the institutions as the IRB 
of record for cooperative research. 

Table 3 shows that 5,164 FWA- 
holding institutions do not have an IRB 
and 2,871 FWA-holding institutions 
have an IRB. We assume that the 5,164 
FWA-holding institutions without an 
IRB have an average of 1 IRB 
authorization agreement that will need 
to be modified as a result of the new 
requirements for agreements between 
institutions and IRBs not operated by 





the institutions in 2017. In addition, we 
assume that the 2,871 FWA-holding 
institutions with an IRB have an average 
of 0.20 IRB authorization agreements 
that would need to be modified in 2017. 
We estimate that each agreement will 
require an average of 10 hours of 
institution legal staff time and 5 hours 
of IRB administrator time to complete. 
The dollar value of their time is 
calculated by multiplying hours by their 
estimated 2017 wages and adjusting for 
overhead and benefits. 


Present value costs of $11.4 million 
and annualized costs of $1.33 million 
are estimated using a 3 percent discount 
rate; present value costs of $10.9 million 
and annualized costs of $1.56 million 
are estimated using a 7 percent discount 
rate. Table 9 summarizes the quantified 
and nonquantified benefits and costs of 
the requirement for written procedures 
and agreements for reliance on IRBs not 
operated by the FWA-holding 
institution (§§ _.103(e) and 
____.115(a)(9) in the final rule). 


TABLE 9—SUMMARY OF REQUIREMENT FOR WRITTEN PROCEDURES AND AGREEMENTS FOR RELIANCE ON IRBS NOT 





























OPERATED BY THE FWA-HOLDING INSTITUTION (§§ -103(e) AND -115(a)(10)) 
Present value of 10 Annualized value over 10 
years by discount rate years by discount rate 
(millions of 2015 dollars) (millions of 2015 dollars) 
3 percent 7 percent 3 percent 7 percent 
BENEFITS: 
Quantified Benefits: 
NON? 4 itchacsiitinurietniiotiniatinolelanininininiadiasinsraliiaiediie.| iaiida denen |) Sieh aaiiaian. |) Ghia itis) Gaia aen 
Nonquantified Benefits: 
None. 
COSTS: 
Quantified Costs: 
Time to modify written agreements between IRBs and institutions ......... 11.4 10.9 1.33 1.56 
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TABLE 9—SUMMARY OF REQUIREMENT FOR WRITTEN PROCEDURES AND AGREEMENTS FOR RELIANCE ON IRBS NOT 
OPERATED BY THE FWA-HOLDING INSTITUTION (§§ _.103(e) AND .115(a)(10))—Continued 





Present value of 10 
years by discount rate 
(millions of 2015 dollars) 


Annualized value over 10 
years by discount rate 
(millions of 2015 dollars) 








3 percent 








7 percent 3 percent 





7 percent 





Nonquantified Costs: 
None. 





g. Eliminating the Requirement That the 
Grant Application Undergo IRB Review 
and Approval (Pre-2018 Rule at 
§___.103(4)) 


The final rule eliminates the 
requirement in the pre-2018 rule that 
grant applications undergo IRB review 
and approval for the purposes of 
certification. The grant application is 
often outdated by the time the research 
study is submitted for IRB review and 
contains detailed information about the 
costs of a study, personnel, and 
administrative issues that go beyond the 
mission of the IRB to protect human 
subjects. Therefore, experience suggests 
that review and approval of the grant 
application is not a productive use of 
IRB time, and the change likely will not 


reduce protections for human subjects 
or impose other costs. 

We estimate that 324,187 initial 
reviews of protocols occur annually, of 
which 223,689 involve convened review 
and 100,498 involve expedited review 
based on the distribution of reviews 
presented in Table 3. For the purpose of 
this analysis, we assume that each 
protocol reviewed by an IRB is 
associated with one grant application or 
other funding proposal. We estimate 
that investigators spend an average of 15 
minutes compiling their grant 
applications when they submit a 
protocol for initial review. Further, we 
estimate that IRBs typically use two 
primary reviewers for convened review 
and one primary reviewer for expedited 
review, and that primary reviewers 


spend an average of 30 minutes 
reviewing the grant application. Based 
on the estimates in Table 3, the dollar 
value of their time is calculated by 
multiplying hours by their estimated 
2017-2026 wages and adjusting for 
overhead and benefits. 


Present value benefits of $326 million 
and annualized benefits of $38.2 million 
are estimated using a 3 percent discount 
rate and present value benefits of $230 
million and annualized benefits of $32.7 
million are estimated using a 7 percent 
discount rate. Table 10 below 
summarizes the quantified and 
nonquantified benefits and costs of 
eliminating the requirement that the 
grant application undergo IRB review 
and approval. 


TABLE 10—SUMMARY OF ESTIMATED BENEFITS AND COSTS OF ELIMINATING THE REQUIREMENT THAT THE GRANT 
APPLICATION UNDERGO IRB REVIEW AND APPROVAL (PRE-2018 RULE AT § .103(f)) 





Present value of 10 
years by discount rate 
(millions of 2015 dollars) 


Annualized value over 10 
years by discount rate 
(millions of 2015 dollars) 








3 percent 7 percent 3 percent 7 percent 
BENEFITS: 
Quantified Benefits: 
Decreased time associated with reviewing grant applications ................. 326 230 38.2 32.7 

















Nonquantified Benefits: 
None. 





COSTS: 
Quantified Costs: 
None 

















Nonquantified Costs: 
None. 





h. Expansion of Exemption Categories 


(§__-.104(d)) 


The final rule includes eight 
exemption categories. Some of these 
categories include subcategories of 
exemptions. 

We note that one pre-2018 exemption 
does not appear in the final rule 
(exemption for educational tests, survey 
procedures, interview procedures, or 
observation of public behavior where a 
statute requires confidentiality of the 
information collected, or where the 


human subjects involved in the activity 
are public figures). We also note that 
several of the final rule exemptions 
were proposed in the NPRM as 
exclusions. Finally, we note that only 
one pre-2018 exemption has been 
unmodified in the final rule (the 
exemption for taste and food quality 
evaluations). 


The exemptions included in the final 
tule are: 


e Certain research involving normal 
educational practices 


e Certain research that involves the 
use of educational tests, survey 
procedures, interview procedures, or 
observation of public behavior 


e Research involving benign 
behavioral interventions in conjunction 
with the collection of information from 
an adult subject through verbal or 
written responses or video recording 


e Research involving the secondary 
use of identifiable private information 
or identifiable biospecimens provided 
that: 
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© The sources are publicly available 

© The information is recorded in such 
a manner that the identity of subjects is 
not readily ascertainable by the 
investigator 

© The research is regulated as “health 
care operations,” ‘“‘public health 
activities,” or “research”? under HIPAA 

© The research is conducted by or on 
behalf of a federal department or agency 
using government-generated or 
government-collected nonresearch 
information, provided that certain 
conditions are met 

e Research and demonstration 
projects conducted or supported by a 
federal department or agency 

© In addition to OHRP’s 
interpretation of this exemption 
expanding under the final rule, and 
language being modified in this 
exemption to reflect that expanded 
interpretation, the final rule also 
includes a requirement that federal 
departments or agencies conducting or 
supporting demonstration projects post 
information about these studies on a 
publicly accessible federal Web site 

e Taste and food quality evaluation 
and consumer acceptance studies 

e The storage and maintenance of 
identifiable biospecimens or identifiable 
private information for unspecified 
secondary research studies 

e The secondary research use of 
identifiable biospecimens or identifiable 
private information where broad 
consent has been sought and obtained 

The goal of the posting requirement in 
the exemption for research and 
demonstration projects (final rule at 
§ _.104(d)(5)) is to promote 
transparency in federally conducted or 
supported activities affecting the public 
that are not subject to oversight under 
the Common Rule. It should not create 
any delay in research. HHS will develop 


a resource that all Common Rule 
departments and agencies may use to 
satisfy the posting requirement 
(accounted for in Section XIX.D.2.a of 
this RIA). Alternatively, an agency can 
create or modify its own Web site for 
this purpose. Thus, increased 
transparency in federally funded or 
supported demonstration projects is a 
non-quantified benefit of the final rule 
modifications. 


Other nonquantified benefits of the 
expansion to the modifications of 
exempt research include clearer 
instructions to the regulated community 
about the extent to which creating a 
system for storing and maintaining 
identifiable biospecimens and 
identifiable private information for 
future, unspecified secondary research 
activities is governed by this rule. 
Additionally, by reducing the IRB 
burden associated with approving this 
type of activity, the new exemption for 
storing and maintaining identifiable 
biospecimens and identifiable private 
information also incentivizes the 
creation of institution-wide, 
comprehensive systems for storing and 
maintaining such biospecimens and 
information. We anticipate that this 
will, in turn, foster research while also 
giving human subjects increased control 
over how their identifiable 
biospecimens and identifiable private 
information will be used (promoting the 
principle of respect for persons). 

Consistent with the NPRM, we 
estimate that 70,916 annual reviews of 
protocols (10.5 percent) would no 
longer be conducted as a result of the 
changes at§ _.104(d). Of these 
reviews, 23,487 will have undergone 
convened initial review, 10,552 will 
have undergone expedited initial 
review, 25,445 will have undergone 


convened continuing review, and 
11,432 will have undergone expedited 
continuing review based on the 
distribution of reviews presented in 
Table 3. 


Further, we estimate that that 1,000 
exempt research and demonstration 
studies are currently conducted each 
year.>5 We further estimate that due to 
the change in OHRP’s interpretation of 
the research and demonstration project 
exemption at§ —_.104(d)(5), an 
additional 3,376 annual reviews of 
protocols (0.5 percent) will no longer be 
conducted. Of these 3,376 reviews, 
1,118 would have undergone convened 
initial review, 502 would have 
undergone expedited initial review, 
1,212 would have undergone convened 
continuing review, and 544 would have 
undergone expedited continuing review 
based on the distribution of reviews 
presented in Table 3. The 4,376 
estimated annual studies conducted 
under this exemption will need to be 
posted on a federal Web site as required 
by § _.104(d)(5)(i). We anticipate that 
it will take individuals at the IRB 
administrative staff level 15 minutes per 
study to post the study on the Web site. 


Present value benefits of $798 million 
and annualized benefits of $93.6 million 
are estimated using a 3 percent discount 
rate, and present value benefits of $653 
million and annualized benefits of $93.0 
million are estimated using a 7 percent 
discount rate. Present value costs of 
$0.37 million and annualized costs of 
$0.04 million are estimated using a 3 
percent discount rate; present value 
costs of $0.30 million and annualized 
costs of $0.04 million are estimated 
using a 7 percent discount rate. Table 11 
summarizes the quantified and 
nonquantified benefits and costs of 
amending an exempt category. 


TABLE 11—SUMMARY OF ESTIMATED BENEFITS AND COSTS OF EXPANDING THE EXEMPTION CATEGORIES (§ .104(d)) 





Present value of 10 
years by discount rate 
(millions of 2015 dollars) 


Annualized value over 10 
years by discount rate 
(millions of 2015 dollars) 








3 percent 7 percent 3 percent 7 percent 
BENEFITS: 
Quantified Benefits: 
Reduction in number Of reVieWS .........ccccccccessccccececessseeeeeeeeesesesseeeeeeeeeseseea 798 653 93.6 93.0 

















Nonquantified Benefits: 


Clarity in what research activities must be reviewed; ability for IRBs to focus efforts on reviews of higher-risk, more complex, research ac- 
tivities; fostering research with biospecimens and identifiable private information. 





COSTS: 
Quantified Costs: 
None 


0.37 








0.30 0.04 0.04 











55 Estimates based on queries of ClinicalTrials.gov 
and a search of the CMS Web site. See e.g., http:// 
www.medicaid.gov/medicaid-chip-program- 


information/by-topics/waivers/ 
waivers_faceted.html, and https://www.cms.gov/ 
Research-Statistics-Data-and-Systems/Statistics- 


Trends-and-Reports/ActiveProjectReports/ 
APR_2011 Edition.html. 
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TABLE 11—SUMMARY OF ESTIMATED BENEFITS AND COSTS OF EXPANDING THE EXEMPTION CATEGORIES (§ 


.104(d))—Continued 





Present value of 10 
years by discount rate 
(millions of 2015 dollars) 


Annualized value over 10 
years by discount rate 
(millions of 2015 dollars) 








3 percent 








7 percent 3 percent 





7 percent 





Nonquantified Costs: 
None. 





i. Elimination of Continuing Review of 
Research Under Specific Conditions 
(§§ .109(f) and .115(a)(3)) 


The final rule eliminates continuing 
review for many minimal risk studies, 
as detailed at § .109(f). Unless an 
IRB determines otherwise, continuing 
review of research is not required if: (1) 
The research is eligible for expedited 
review in accordance with § _.110; 
(2) the research is reviewed by the IRB 
in accordance with the limited IRB 
review procedure described in several of 
the exemption categories (specifically, 
§ _.104(d)(2)(iii), 
§__.104(d)(3)(@)(C), §__—-104(d)(7), 
or§ _.104(d)(8)); or (3) the research 
has progressed to the point that it only 
involves data analysis (including 
analysis of identifiable information or 
identifiable biospecimens) or access to 
follow-up clinical data from procedures 
that subjects would undergo as part of 
clinical care. If an IRB chooses to 
conduct continuing review even when 
these conditions are met, the rationale 
for doing so must be documented 





according to a new provision at 
§ _.115(a)(3). 

We estimate that 108,873 expedited 
continuing reviews of protocols occur 
annually, based on the distribution of 
reviews presented in Table 3. Of these 
reviews, we further estimate that 81,546 
reviews (75 percent) will not be 
eliminated by other changes to the 
Common Rule (such as the 
modifications at§ _.104(d)). It is 
estimated that 40,773 of these 81,546 
reviews (50 percent) will be 
discontinued under § _.109(f), and 
the remaining 40,773 reviews (50 
percent) will still require 
documentation of the rationale for doing 
so (as required under § —_.115(a)(3)). 
We also estimate that IRB voting 
members will spend 1 hour per review 
providing the necessary documentation. 
In addition, administrative staff at each 
IRB will spend an estimated 10 hours in 
2017 updating their communication 
systems to no longer send continuing 
review reminders to affected 
investigators. 


The estimated costs to institution 
officials, IRB administrators, IRB 
administrative staff, IRB chairs, IRB 
voting members, and investigators of 
conducting these reviews are based on 
the estimates presented in Table 3. The 
dollar value of their time is calculated 
by multiplying hours by their estimated 
2017-2026 wages and adjusting for 
overhead and benefits. 


Present value benefits of $148 million 
and annualized benefits of $17.4 million 
are estimated using a 3 percent discount 
rate, and present value benefits of $121 
million and annualized benefits of $17.3 
million are estimated using a 7 percent 
discount rate. Present value costs of 
$41.0 million and annualized costs of 
$4.80 million are estimated using a 3 
percent discount rate; present value 
costs of $33.7 million and annualized 
costs of $4.80 million are estimated 
using a 7 percent discount rate. Table 12 
summarizes the quantified and 
nonquantified benefits and costs of the 
elimination of continuing review of 
research under specific conditions. 


TABLE 12—SUMMARY OF ESTIMATED BENEFITS AND COSTS OF THE ELIMINATION OF CONTINUING REVIEW OF RESEARCH 
UNDER SPECIFIC CONDITIONS (§§ .109(f) AND .115(a)(3)) 
































Present value of 10 years by Annualized value over 10 
discount rate years by discount rate 
(millions of 2015 dollars) (millions of 2015 dollars) 
3 percent 7 percent 3 percent 7 percent 
BENEFITS: 
Quantified Benefits: 
Reduction in number of continuing reVieWS ......... eee eee eee eeneeeeeeeee 148 121 17.4 17.3 
Nonquantified Benefits: 
None. 
3 Percent 7 Percent 3 Percent 7 Percent 
COSTS: 
Quantified Costs: 
Time to document rationale for conducting continuing review and up- 
date IRB communication SySteMS ooo... eee cece eeee tee eeseeseeeeeeeeenees 41.0 33.7 4.80 4.80 

















Nonquantified Costs: 
None. 
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j. Expedited Review Procedures 
(§§ .110 and .115(a)(8)) 


The final rule changes the default 
position such that any research activity 
appearing on the expedited review list 
is presumed to be minimal risk. 
Additionally, the final rule requires 
that, in consultation with other 
Common Rule departments or agencies, 
the expedited review categories be 
reviewed every 8 years and amended as 
appropriate, followed by publication in 
the Federal Register and solicitation of 
public comment. Finally, the final rule 
contains a new requirement at 
§ _.115(a)(8) concerning IRB records, 
requiring that IRBs document the 
rationale for an expedited reviewer’s 
determination that research activities 
appearing on the expedited review list 
are more than minimal risk (i.e., an 
override of the presumption that studies 


on the Secretary’s list of expedited 
review activities are minimal risk). We 
note that because the final rule does not 
include a proposal to develop guidance 
with a list of activities presumed to be 
minimal risk, cost estimates in the final 
rule have been modified accordingly. 
Changes to the expedited review 
procedures are expected to reduce IRB 
workload by decreasing the amount of 
time IRB voting members spend making 
minimal risk determinations and 
documenting such determinations. 
Nonquantified benefits include a 
reduction in the number of studies that 
require full, convened IRB review 
should more categories of activities be 
added to the expedited review list. 
According to the estimates presented 
in Table 3, 209,371 protocols undergo 
expedited review each year. For these 
protocols, we estimate that, as a result 


of these changes, IRB voting members 
will spend an average of 15 fewer 
minutes per protocol developing and 
documenting a rationale for why certain 
activities that are permitted to be 
reviewed under the expedited review 
procedure are minimal risk. 

The dollar value of IRB voting 
member time is calculated by 
multiplying hours by their estimated 
2017-2026 wages and adjusting for 
overhead and benefits. 

Present value benefits of $51.0 million 
and annualized benefits of $5.98 million 
are estimated using a 3 percent discount 
rate, and present value benefits of $41.7 
million and annualized benefits of $5.94 
million are estimated using a 7 percent 
discount rate. Table 13 summarizes the 
quantified and nonquantified benefits 
and costs of amending expedited review 
procedures. 


TABLE 13—SUMMARY OF ESTIMATED BENEFITS AND COSTS OF AMENDING THE EXPEDITED REVIEW PROCEDURES 


(§§_—«.110 AND —_..115(a)(8)) 





Present value of 10 years by 
discount rate 
(millions of 2015 dollars) 


Annualized value over 10 
years by discount rate 
(millions of 2015 dollars) 





3 percent 


7 percent 3 percent 7 percent 





BENEFITS: 
Quantified Benefits: 


Reduction in time spent making and documenting minimal risk deter- 
minations and documenting such determinations 


51.0 








41.7 5.98 5.94 











Nonquantified Benefits: 
None. 





COSTS: 
Quantified Costs: 
None 


3 Percent 








7 Percent 3 Percent 7 Percent 











Nonquantified Costs: 
None. 





k. Cooperative Research (§ .114)) 


The final rule requires under 
§ .114 that any institution located in 
the United States that is engaged in 
cooperative research shall rely on 
approval by a single IRB for that portion 
of the research that is conducted in the 
United States. This policy has two 
exceptions (detailedin § —_.114(b)(2)): 
(1) Cooperative research for which more 
than single IRB review is required by 
law (including tribal law passed by the 
official governing body of a American 
Indian or Alaska Native tribe); and (2) 
research for which any federal 
department or agency supporting or 
conducting the research determines and 
documents that the use of a single IRB 
is not appropriate for the particular 
study. Nonquantified benefits of this 
change include standardization of 





human subjects protections in multi- 
institutional studies. 


Ultimately, these revisions are 
expected to lower costs associated with 
multiple reviews for investigators, 
institutions, and IRBs. Some cost 
shifting may occur as certain IRBs 
assume the role of reviewing IRB. 
However, these will be offset by savings 
at other IRBs that are no longer required 
to conduct additional reviews of the 
same research study. Initially, IRBs and 
institutions will have to draft and revise 
their policies regarding their reliance on 
single IRBs. It is expected that, over 
time, reliance agreements and other 
methods of documenting external 
reliance will become standardized, 
which will result in reduced costs 
associated with multiple reviews and 


time savings for investigators who no 
longer must wait for multiple reviews. 


The OHRP database of registered 
institutions and IRBs shows that 8,035 
institutions have an FWA. We estimate 
that these institutions will develop an 
average of 10 written joint review 
agreements with other institutions in 
2019 before the first year of compliance. 
We further estimate that each agreement 
will require an average of 10 hours of 
institution legal staff time and 5 hours 
of IRB administrator time to complete. 
The dollar value of their time is 
calculated by multiplying hours by their 
estimated wages and adjusting for 
overhead and benefits. 


We estimate that 202,617 annual 
reviews of multi-institutional protocols 
take place, and an average of 5 reviews 
per multi-institutional protocol, 
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implying that 40,523 multi-institutional 
protocols are reviewed each year. We 
further estimate that 16,209 (40 percent) 
of these multi-institutional studies are 
funded by NIH °¢ and thus will already 
be subject to NIH’s single IRB review 
policy. Accordingly, we estimate that 
approximately 97,256 annual reviews of 
protocols will no longer be conducted as 
a result of these proposed changes. Of 
these reviews, 32,211 would have 
undergone convened initial review, 
14,472 would have undergone 
expedited initial review, 34,896 would 
have undergone convened continuing 
review, and 15,678 would have 
undergone expedited continuing review 
based on the distribution of reviews 
presented in Table 3. 

In response to comments on the 
NPRM RIA, we have modified our 
assumptions of how much time would 
ultimately be saved by the 
implementation of this proposal (see 


Section XIX.C of this RIA). We assume 
that investigators for whom multi- 
institutional reviews are eliminated will 
face a reduction in burden associated 
with the elimination of the site-specific 
protocol review, but will face increased 
burden in the form of coordination with 
investigators at other sites, for example, 
to ensure that the results of the IRB 
review are effectively communicated. 
Specifically, we assume that the 
elimination of multi-institutional 
reviews will result in investigators 
spending half as much time engaging 
with the review process as they would 
have if IRB review had taken place at all 
sites. 

The estimated costs to institution 
officials, IRB administrators, IRB 
administrative staff, IRB chairs, IRB 
voting members, and investigators of 
conducting these reviews are based on 
the estimates presented in Table 3, 
adjusted accordingly to account for our 


assumption that the time savings for 
these eliminated reviews is reduced by 
half for investigators. The dollar value 
of their time is calculated by 
multiplying hours by their estimated 
2020-2026 wages and adjusting for 
overhead and benefits. 


Present value benefits of $538 million 
and annualized benefits of $63.1 million 
are estimated using a 3 percent discount 
rate, and present value benefits of $414 
million and annualized benefits of $59.0 
million are estimated using a 7 percent 
discount rate. Present value costs of 
$157 million and annualized costs of 
$18.3 million are estimated using a 3 
percent discount rate; present value 
costs of $140 million and annualized 
costs of $19.9 million are estimated 
using a 7 percent discount rate. Table 14 
summarizes the quantified and 
nonquantified benefits and costs of 
cooperative research. 





























TABLE 14—SUMMARY OF ESTIMATED BENEFITS AND COSTS OF COOPERATIVE RESEARCH (§ .114) 
Present value of 10 years by Annualized value over 10 
discount rate years by discount rate 
(millions of 2015 dollars) (millions of 2015 dollars) 
3 percent 7 percent 3 percent 7 percent 
BENEFITS: 
Quantified Benefits: 
Reduction in number of reVieWS 0.0... eee cess ceee eee e tees seeeeeeeseneeeaeeeed 538 414 63.1 59.0 
Nonquantified Benefits: 
Standardization of human subjects protections in multi-institutional studies. 
3 Percent 7 Percent 3 Percent 7 Percent 
COSTS: 
Quantified Costs: 
Time required to develop model reliance agreement and written joint 
TEVICW AGFECMEMMS 0.0... cceeccssscesccssnesseenecescsseseseessccesseenseeeeneeseeresseeseeeeons 157 140 18.3 19.9 

















Nonquantified Costs: 
None. 





1. Changes in the Elements of Consent, 

Including Documentation 

(§§___.116(a)(5), (b)(9), (c)(7)-(9), and 
.117(b)) 


The final rule imposes a new 
requirement at§ _.116(a)(5)(i) that 
informed consent must begin with a 
concise and focused presentation of the 
key information that is most likely to 
assist a prospective subject or legally 
authorized representative in 
understanding the reasons why one 
might or might not want to participate 
in the research. This provision further 
mandates that this part of the informed 
consent must be organized and 
presented in a way that facilitates 
comprehension. This requirement 


56 Moral Science: Protecting Participants in 
Human Subjects Research. Washington, DC: 


applies to all informed consent 
processes, except for broad consent 
obtained pursuantto§ —_.116(d), 
which may warrant a different 
presentation. 

The final rule includes a new element 
of consent at § —_—.116(b)(9) that 
requires one of the following statements 
be included for any research that 
involves the collection of identifiable 
private information or identifiable 
biospecimens: 

e A statement that identifiers might 
be removed from the identifiable private 
information or identifiable 
biospecimens and that, after such 
removal, the information or 
biospecimens could be used for future 


Presidential Advisory Commission for the Study of 
Bioethical Issues. Retrieved from http:// 


research studies or distributed to 
another investigator for future research 
studies without additional informed 
consent from the subject or the legally 
authorized representative, if this might 
be a possibility; or 

e A statement that the subject’s 
information or biospecimens collected 
as part of the research, even if 
identifiers are removed, will not be used 
or distributed for future research 
studies. 


This new requirement is intended to 
give the potential subject the knowledge 
that identifiers might be removed from 
information or biospecimens for their 
use in future research without 
additional consent, when such a 


bioethics.gov/sites/default/files/ 
Moral% 20Science % 20June % 202012.pdf, p. 34. 
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possibility exists, so he or she can make 
a fully informed decision about whether 
to participate in the research. If subjects’ 
identifiable private information or 
identifiable biospecimens will not be 
used for future research studies, even if 
identifiers are removed, this new 
element of consent requires that subjects 
be informed of this as well. 

The final rule’s three additional 
elements of consent are in 
§ _.116(c)(7), (8), and (9). These 
require that a subject be informed of the 
following, when appropriate: 

e That the subject’s biospecimens 
(even if identifiers are removed) may be 
used for commercial profit and whether 
the subject will or will not share in this 
commercial profit; 

e Whether clinically relevant research 
results, including individual research 
results, will be disclosed to subjects, 
and if so, under what conditions. 

e For research involving 
biospecimens, whether the research will 
(if known) or might include whole 
genome sequencing (i.e., sequencing of 
a human germline or somatic specimen 


with the intent to generate the genome 
or exome sequence of that specimen. 
These three additional elements of 
consent will promote respect for 
persons and greater transparency in the 
research enterprise. Additionally, 
including the information referenced in 
these provisions in a consent form will 
help ensure that prospective subjects are 
given information necessary for 
understanding why one might want to 
participate (or not) in a research study. 
The language at§ —_—.117(b)(1) in the 
final rule was modified to reference 
§ _.116(a)(5)(i) and state that if a 
short form consent process is used, the 
key information required by 
§ _.116(a)(5)(i) must be presented 
first to the prospective subject, before 
other information, if any, is provided. 
We estimate that 246,382 new 
protocols annually use identifiable 
information. For each protocol, we 
estimate that investigators will spend an 
average of 15 minutes in 2017 updating 
consent forms to comply with the new 
requirements found in the final rule at 


§__.116(a)(5), (b)(9), (c)(7), (c)(8), or 


(c)(9). Based on the estimates presented 
in Table 3, the dollar value of 
investigators’ time is calculated by 
multiplying hours by their estimated 
2017 wages and adjusting for overhead 
and benefits. 


We assume that few additional 
investigators will elect to offer the 
second option at § _.116(b)(9), and 
that the investigators who currently 
offer equivalent options already track 
the permissible and impermissible uses 
of information in line with the 
requirements discussed above. As a 
result, we estimate that no additional 
costs are associated with tracking. 


Present value costs of $4.62 million 
and annualized costs of $0.54 million 
are estimated using a 3 percent discount 
rate; present value costs of $4.32 million 
and annualized costs of $0.62 million 
are estimated using a 7 percent discount 
rate. Table 15 summarizes the 
quantified and nonquantified benefits 
and costs of changes in the basic 
elements of consent, including 
documentation. 


TABLE 15—SUMMARY OF ESTIMATED BENEFITS AND COSTS OF CHANGES IN THE ELEMENTS OF CONSENT, INCLUDING 
DOCUMENTATION (§§ __.116(a)(5), (b)(9), (c)(7), (c)(8) AND __.117(b)) 





Present val 


years by discount rate 
(millions of 2015 dollars) 


Annualized value over 10 
years by discount rate 
(millions of 2015 dollars) 


ue of 10 





3 percent 


7 percent 3 percent 7 percent 





BENEFITS: 
Quantified Benefits: 
None 

















Nonquantified Benefits: 


Improved informed consent forms and processes; greater transparency in the research enterprise. 





COSTS: 
Quantified Costs: 
Time to update consent forms 








4.62 








4.32 0.54 0.62 





Nonquantified Costs: 
None. 





m. Obtaining Consent to Secondary Use 
of Identifiable Biospecimens and 
Identifiable Private Information 


(§__—.116(d)) 


Because the final rule does not adopt 
the NPRM proposal to consider all 
biospecimens as human subjects 
regardless of identifiability, the costs 
associated with seeking, obtaining, and 
tracking broad consent are reduced 
significantly. As noted above, comments 
on the NPRM suggest that the costs 
associated with building systems to 
track broad consent are very 
burdensome. Therefore, we expect that 
broad consent and institution-wide 


tracking systems will be pursued only in 
situations where it generates net 
benefits. As a result, in the short term, 
we are unsure of the extent to which 
institutions will adopt institution-wide 
mechanisms to seek, obtain, and track 
broad consent. We anticipate in the 
short term that broad consent (and the 
attendant tracking and maintenance 
obligations) will be a system used and 
managed by investigators or teams of 
investigators in their research portfolios. 
However, we believe that it will be 
adopted more over time at an 
institutional level as IT systems evolve 
at research institutions through normal 
practice. We lack data to estimate the 


number of research studies for which 
this option will be adopted. Each of 
these studies will have some variable 
costs (e.g., consent, tracking) and fixed 
costs (IT infrastructure). Because this is 
optional, we believe that it will be 
pursued only if private benefits exceed 
private costs. Therefore, we anticipate 
benefits, in terms of improvements in 
the quality and efficiency of human 
subjects research, proportional to the 
adoption of broad consent. We note that 
the voluntary nature of adoption implies 
that broad consent may not be sought in 
some situations where its social benefit 
exceeds its social cost. 


Federal Register/Vol. 82, No. 12/Thursday, January 19, 2017/Rules and Regulations 


7249 








TABLE 16—SUMMARY OF ESTIMATED BENEFITS AND COSTS OF OBTAINING CONSENT TO SECONDARY USE OF 
IDENTIFIABLE BIOSPECIMENS AND IDENTIFIABLE PRIVATE INFORMATION (§ .116(d)) 





Present value of 10 
years by discount rate 
(millions of 2015 dollars) 


Annualized value over 10 
years by discount rate 
(millions of 2015 dollars) 





3 percent 


7 percent 3 percent 7 percent 





BENEFITS: 
Quantified Benefits: 


NONG ii seiecceiee fans cena india atineaene 





Nonquantified Benefits: 


Improvements in the quality and efficiency of human subjects research. 





COSTS: 
Quantified Costs: 


NONG? asesetiienidiwiais eaieeedcieeresee 

















Nonquantified Costs: 


Time and infrastructure required to obtain and track broad consent. 





n. Allowing IRBs To Approve a 
Research Proposal for Subject 
Recruitment Activities Without 
Granting a Waiver of Consent 
(§___.116(g)) 


The final rule will allow an IRB to 
approve a research proposal in which 
investigators obtain information or 
biospecimens without individuals’ 
informed consent for the purpose of 
screening, recruiting, or determining the 
eligibility of prospective human subjects 
of research in certain circumstances. 


This addresses concerns that the pre- 
2018 regulations required an IRB to 
determine that informed consent could 
be waived before investigators could 
record identifiable private information 
for the purpose of screening, recruiting, 
or determining the eligibility of 
prospective subjects for a research 
study. The pre-2018 rule requirement 
was viewed as burdensome without 


providing meaningful protections to 
subjects. 

The policy adopted in the final rule 
should result in time and cost savings 
for investigators and IRBs, but they 
likely will be small. The savings will 
come from IRBs no longer needing to 
consider whether informed consent can 
be waived for such preparatory-to- 
research activities. Savings will accrue 
for investigators who can proceed with 
such activities in less time. 

We estimate that 1,620 annual initial 
reviews of protocols (0.5 percent) 
involve a waiver of consent for 
recruitment activities that will not be 
required as a result of these changes. Of 
these reviews, 1,118 will have 
undergone convened initial review and 
502 will have undergone expedited 
initial review based on the distribution 
of reviews presented in Table 3. We 
estimate that investigators spend an 
average of 15 minutes requesting a 
waiver of consent for recruitment 


activities when they submit a protocol 
for initial review. We further estimate 
that IRBs typically use two primary 
reviewers for convened review and one 
primary reviewer for expedited review, 
and that primary reviewers spend an 
average of 15 minutes determining 
whether informed consent can be 
waived. Based on the estimates in Table 
3, the dollar value of their time is 
calculated by multiplying hours by their 
estimated 2017-2026 wages and 
adjusting for overhead and benefits. 


Present value benefits of $1.25 million 
and annualized benefits of $0.15 million 
are estimated using a 3 percent discount 
rate, and present value benefits of $0.88 
million and annualized benefits of $0.13 
million are estimated using a 7 percent 
discount rate. Table 17 summarizes the 
quantified and nonquantified benefits 
and costs of eliminating the requirement 
to waive consent in certain subject 
recruitment activities. 


TABLE 17—SUMMARY OF ESTIMATED BENEFITS AND COSTS OF ELIMINATION OF REQUIREMENT TO WAIVE CONSENT IN 
CERTAIN SUBJECT RECRUITMENT ACTIVITIES (§ .116(g)) 





Present value of 10 years 
by discount rate 
(millions of 2015 dollars) 


Annualized value over 10 
years 
by discount rate 





(millions of 2015 dollars) 


























eipeleen percent 3 percent 7 percent 
Quantified Benefits: 
Decreased time associated with reVieW ...........ccccccccssseeeceesesssteeeeeeeeeeseees 1.25 0.88 0.15 0.13 
BENEFITS: 
Nonquantified Benefits: 
None. 
3 Percent 7 Percent 3 Percent 7 Percent 
COSTS: 


Quantified Costs: 
None. 
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TABLE 17—SUMMARY OF ESTIMATED BENEFITS AND COSTS OF ELIMINATION OF REQUIREMENT TO WAIVE CONSENT IN 
CERTAIN SUBJECT RECRUITMENT ACTIVITIES (§ .116(g))—Continued 





Present value of 10 years 
by discount rate 
(millions of 2015 dollars) 


Annualized value over 10 
years 
by discount rate 





3 percent 





(millions of 2015 dollars) 





7 percent 





3 percent 7 percent 





Nonquantified Costs: 
None. 





o. Requirement for Posting of Consent 
Forms for Common Rule Department or 
Agency-Supported Clinical Trials 
(§__.116(h)) 


The final rule requires that for each 
clinical trial conducted or supported by 
a Federal department or agency, one 
IRB-approved form used to recruit 
subjects must be posted by the awardee 
or the federal department or agency 
component conducting the trial on a 
publicly available federal Web site that 
will be established as a repository for 
such informed consent forms. The 
consent form must be posted after the 
clinical trial is closed to recruitment 
and no later than 60 days after the last 
study visit by any subject, as required 
by the protocol. This provision permits 
federal departments or agencies to 
require or permit redactions to these 
consent forms. As described in Section 
XIV.H, federal departments or agencies 
have great latitude in what they may 
permit or require be redacted. 

We believe that public posting of 
consent forms will increase 
transparency, enhance confidence in the 
research enterprise, increase 
accountability, and inform the 


development of future consent forms, 
possibly resulting in future savings in 
time for investigators developing 
consent forms. Costs to the Federal 
Government in creating and maintaining 
such a repository are described in 
Section XIX.D.2.a of this RIA. 

According to queries of 
ClinicalTrials.gov, estimated 5,270 
clinical trials are conducted or 
supported by Common Rule agencies, of 
which an estimated 575 are regulated by 
provisions in the Federal Food, Drug, 
and Cosmetic (FD&C) Act and Trade 
Secrets Act based on the information 
presented in Table 3. For the purpose of 
this analysis, it is assumed that each 
clinical trial is associated with one 
consent form that must be submitted to 
the federal system by an investigator. 

It is unknown at this time in what 
other circumstances federal departments 
or agencies might permit or require 
redaction, thus the RIA calculates 
redaction time only in those studies for 
which the FD&C Act and Trade Secrets 
Act applies. For the 575 clinical trials 
regulated by provisions in the FD&C Act 
and Trade Secrets Act, it is estimated 
that investigators will spend an average 
of 30 minutes redacting information 


before submission. We estimate that 
investigators will spend an average of 15 
minutes submitting each consent form. 


Based on the estimates presented in 
Table 3, the dollar value of investigator 
time is calculated by multiplying hours 
by their estimated 2017-2026 wages and 
adjusting for overhead and benefits. 


In addition, submitted consent forms 
must be reviewed and made accessible 
to persons with disabilities in 
compliance with Section 508 
Amendment to the Rehabilitation Act of 
1973. We estimate that each consent 
form contains an average of 10 pages 
and that making each page 508- 
compliant costs an average of $30 per 
page. 

Present value costs of $15.4 million 
and annualized costs of $1.80 million 
are estimated using a 3 percent discount 
rate; present value costs of $11.0 million 
and annualized costs of $1.56 million 
are estimated using a 7 percent discount 
rate. Table 18 summarizes the 
quantified and nonquantified benefits 
and the requirement for posting of 
consent forms for Common Rule 
department or agency-supported clinical 
trials. 


TABLE 18—SUMMARY OF ESTIMATED BENEFITS AND COSTS OF REQUIREMENT FOR POSTING OF CONSENT FORMS FOR 
COMMON RULE DEPARTMENT OR AGENCY-SUPPORTED CLINICAL TRIALS (§ .116(h)) 





Present value of 10 years 
by discount rate 
(millions of 2015 dollars) 





3 percent 7 percent 


Annualized value over 10 
years 
by discount rate 
(millions of 2015 dollars) 





3 percent 7 percent 





Quantified Benefits: 


NON) stein Sad rita cdi lntined aviv neratiedsieettewssaeetiendts 

















BENEFITS: 
Nonquantified Benefits: 


Increase transparency of Common Rule department or agency-supported clinical trials; improvement of clinical trial informed consent forms. 





COSTS: 
Quantified Costs: 


Preparation and submission of consent forms for posting, and redaction 
OF INFOTMAUNOMN: 208, oc evccs Gaateeteteecesicrescteanarhentansieoeis attetssunedes 





3 Percent 7 Percent 





15.4 11.0 





3 Percent 7 Percent 





1.80 1.56 





Nonquantified Costs: 
None. 
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p. Alteration in Waiver for 
Documentation of Informed Consent in 
Certain Circumstances 


(§__.117(c)(1) (iii) 


The final rule adds a provision 
allowing a waiver of the requirement to 
obtain a signed informed consent form 
if the subjects are members of a distinct 
cultural group or community in which 
signing documents is not the norm. This 
will be allowed only if the research 
presents no more than minimal risk of 
harm to subjects and provided an 
appropriate alternative method is 


available to document that informed 
consent was obtained. 

Under the pre-2018 rule, IRBs could 
waive the requirement for the 
investigator to obtain a signed consent 
form for some or all subjects. The pre- 
2018 criteria for such a waiver may not 
have been flexible enough for dealing 
with a variety of circumstances, such as 
when federally sponsored research is 
conducted in an international setting 
where, for example, cultural or 
historical reasons suggest that signing 
documents may be viewed as offensive 
and problematic. 


This should not involve cost as its 
intent is to improve the informed 
consent process by providing more 
flexibility regarding the documentation 
of consent (an ethical gain) while 
reducing administrative requirements 
for investigators and research subjects in 
specific circumstances. Thus, benefits 
and costs of this new provision are not 
quantified. Table 19 summarizes the 
nonquantified benefits and costs of 
alteration in waiver for documentation 
of informed consent in certain 
circumstances. 


TABLE 19—SUMMARY OF ESTIMATED BENEFITS AND COSTS OF ALTERATION IN WAIVER FOR DOCUMENTATION OF 
INFORMED CONSENT IN CERTAIN CIRCUMSTANCES (§ _.117(c)(1)(iii)) 





Present value of 10 
years by discount rate 
(millions of 2015 dollars) 


Annualized value over 10 
years by discount rate 
(millions of 2015 dollars) 





3 percent 


7 percent 3 percent 7 percent 





BENEFITS: 
Quantified Benefits: 
None 

















Nonquantified Benefits: 


Improved informed consent process for distinct cultural groups and communities. 





COSTS: 
Quantified Costs: 
None 

















Nonquantified Costs: 
None. 





E. Alternative Approaches to the 
Definition of Human Subject (NPRM at 
§ .102(e)) and Related Provisions 


1. Overview 


We carefully considered the option of 
not pursuing regulatory action. 
However, because of shifts in science, 
technology, public engagement, and 
public expectations in the past 2 
decades, a wide range of stakeholders 
have raised concerns about the 
limitations of the existing ethical 
framework in research, arguing for a re- 
evaluation of how the fundamental 
principles that underlie the Common 
Rule—tespect for persons, beneficence, 
and justice—are applied in practice to 
the myriad new contexts in which U.S. 
research is conducted in the 21st 
century. 

The final rule addresses these 
concerns through three aims. The first 
aim is to increase human subjects’ 
ability and opportunity to make 
informed decisions. The second aim is 
to reduce potential for harm and 
promote justice by increasing the 
uniformity of human subject 
protections. The third aim is to facilitate 
current and evolving types of research 


that offer promising approaches to 
treating and preventing medical and 
societal problems by reducing ambiguity 
in interpretation of the regulations, 
increasing efficiencies in the review 
system, and reducing requirements on 
investigators when said requirements do 
not appear to provide meaningful 
protections to human subjects. We hope 
that these changes will also build public 
trust in the research system. We 
estimate that the benefits of this 
regulatory action exceed its costs, and as 
a result we have chosen to pursue this 
regulatory action. 

The NPRM proposed to expand the 
definition of human subjects to include 
research in which an investigator 
obtains, uses, studies or analyzes a 
biospecimen. This would have applied 
regardless of the identifiability of the 
biospecimen. Generally, investigators 
would not have been allowed to remove 
identifiers from biospecimens without 
obtaining informed consent or a waiver 
of consent. The NPRM also proposed to 
modify the criteria for waiver of consent 
in research involving biospecimens 
such that a waiver would be very rare. 
Written consent would generally have 
been required for such activities. Thus, 


this change would have significantly 
expanded the amount of research 
subject to the Common Rule. This 
requirement would not have applied to 
biospecimens and information already 
collected at the time the final rule is 
published. The NPRM proposed to 
exclude from its scope research 
activities involving nonidentified 
biospecimens where no new 
information about an individual is 
generated. Although activities such as 
developing new testing assays could 
have been excluded under this 
provision, it is anticipated that under 
the NPRM proposals, most research 
with biospecimens would have come 
under the rule. 

In addition to promoting respect for 
persons in the research enterprise, the 
alternative regulatory structure for 
research with biospecimens (whereby 
consent is sought for almost all research 
activities involving biospecimens) 
would have encouraged investigators to 
retain identifiers, which can enhance 
research by preserving the ability to link 
biospecimens to important additional 
information about the subject. 
Additionally, members of the regulated 
community have reported situations 
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where, even though not currently 
required by regulation, investigators 
were told by an IRB that they needed to 
obtain study-specific consent for 
research activities involving 
nonidentified biospecimens. Under the 
NPRM proposals, such a situation 
would not occur because consent—be it 
broad or study-specific—would always 
be obtained for research involving 
biospecimens. 

Though this proposal would promote 
the ethical principle of respect for 
persons, it also would have significantly 
increased the volume of studies for 
which investigators must seek and 
document informed consent (unless 
more stringent waiver criteria were 
met). Additionally, the NPRM 
acknowledged, and the regulated 
community reiterated, during the public 
comment period, that the majority of the 
studies that the NPRM proposal would 
have newly regulated were studies 
involving no more than minimal risk to 
human subjects. 

As an example of the tradeoffs 
between the NPRM proposal and the 
ultimate position taken in the final rule, 
some commenters noted that the 
proposal to cover all biospecimens 
under the Common Rule regardless of 
identifiability might privilege the 
Belmont Report’s principle of autonomy 
over the principle of justice. Because the 
NPRM would have required 
investigators to obtain informed consent 
in all but rare circumstances for 
research involving biospecimens, 
concern was expressed that this could 
result in lower representation rates in 
research of minority groups, 
marginalized members of society, and 
citizens receiving care in community 
health clinics (which would be less able 
to cover the costs of tracking consent 
status over time). We note that although 
the available literature suggests that 
minority consent rates are generally 
high, minority consent rates in some 
cases may be lower than for 
nonminorities.57 5859 This discrepancy 
in turn could create issues in the 
applicability of research discoveries on 
the population as a whole. Respecting 
persons is a worthy goal, but the need 
to achieve representative samples (and 
thus helping to ensure the applicability 


57 Pentz RD, et al. Research on Stored Biological 
Samples: Views of African American and White 
American Cancer Patients. American Journal of 
Medical Genetics, Part A. 2006 Apr; 140(7):733- 
739. 

58 Chen, DT et al. Research With Stored Biological 
Samples; What Do Research Participants Want? 
Archives of Internal Medicine 2005 Mar; 
165(6):652-655. 

59 Scott EA, et al. Biospecimen Repositories: Are 
Blood Donors Willing to Participate? Transfusion. 
2010 September; 50(9):1943-1950. 


of research findings across a population) 
also must be taken into consideration. In 
addition, the principle of beneficence 
requires that all reasonable efforts be 
made to improve the public good. To 
balance these sometimes competing 
interests, the final rule incentivizes 
asking potential subjects for permission 
in minimal risk activities (even if a 
waiver of informed consent could be 
sought from an IRB), while still allowing 
other avenues for this research to occur 
should compelling reasons exist or not 
obtaining informed consent. 


2. Estimated Impact of Alternative 
Approaches to the Final Rule 


The benefit and cost estimations 
presented below are based upon the 
proposals and structure presented in the 
NPRM, not the provisions included in 
the final rule. 


a. Estimating How Many Studies 
Involving Nonidentified Biospecimens 
Occur Each Year 


We estimate that each year 250,000 
studies are not currently subject to 
oversight by either the Common Rule or 
FDA regulations because they use 
biospecimens that have been stripped of 
identifiers. Extrapolations from 1999 
data ©° suggest that biospecimens are 
collected from as many as 30 million 
individuals each year and are stored for 
both clinical and research purposes. 
Based on conversations with experts in 
this area, this 1999 report represents the 
most recent, comprehensive analysis of 
the volume of nonidentified 
biospecimens used in research 
activities. 

Approximately 9 million individuals’ 
biospecimens (30 percent of those 
collected) are collected for research 
purposes. Approximately 6.3 million 
individuals’ biospecimens (30 percent) 
could potentially be used in future 
research studies. Thus, it is possible that 
investigators would have had to seek 
consent to secondary use of 
biospecimens or a waiver of consent for 
an additional 15 million individuals 
annually for secondary use of 
biospecimens. 

In the absence of comprehensive data, 
to calculate the number of protocols that 
would have been covered, we proposed 
two approaches. Under method one, we 
estimated that approximately 50 
biospecimens would have been used on 
average per research protocol involving 
biospecimens. This gave a potential 
300,000 new research protocols using 
nonidentified biospecimens. This 


60 Fiseman E., Haga S. Handbook of Human 
Tissue Sources: A National Resource of Human 
Tissue Samples. Washington, DC: RAND 
Corporation; 1999. 


estimate of 300,000 new research 
protocols was rounded down to 250,000 
new studies based on ANPRM 
comments and industry data, because it 
seemed reasonable to assume that the 
number of new biospecimen studies 
covered by the alternative proposal 
would equal the total number of new 
protocols conducted each year (i.e., the 
number of new biospecimen studies was 
likely close to the estimate of 246,382 
new annual studies each year). 

Under method two, biospecimen 
repository representatives reported that 
roughly 90 percent of their collections 
were used in nonidentified form in 
research activities that did not fall 
under the pre-2018 rule. Thus, only 10 
percent of biospecimen studies were 
covered under the pre-2018 rule, 
representing a 9:1 ratio of studies 
involving nonidentified biospecimens to 
studies involving identifiable 
biospecimens. Of the 246,382 new 
protocols each year that were 
nonexempt (Table 3), we assumed that 
10 to15 percent used identifiable 
biospecimens. This equated to between 
24,638 and 36,957 new studies each 
year using identifiable biospecimens. 
We estimated that the number of 
biospecimen studies that occurred on 
nonidentified biospecimens each year 
was approximately 9 times the number 
of studies using identifiable 
biospecimens, or between 221,742 and 
332,613 studies each year. Thus, under 
method two, an estimate of 250,000 new 
studies on nonidentified biospecimens 
each year was also reasonable. 

To facilitate research with 
biospecimens, the NPRM proposed to 
create separate elements of broad 
consent such that investigators and 
institutions could seek, and individuals 
could grant, consent for future 
unspecified research activities. The 
NPRM also proposed an exemption that 
relied on obtaining broad consent for 
future, unspecified research studies. To 
be eligible for the proposed exemption 
for specific secondary studies, broad 
consent must have been sought and 
obtained using the proposed Secretary’s 
template for broad consent, and the 
investigator must not have anticipated 
returning individual research results to 
subjects. 


b. Facilitating Research With 
Nonidentified Biospecimens Under the 
NPRM: Exemption for Specific, 
Secondary Studies When Broad Consent 
Had Been Sought and Obtained 


The NPRM proposed to allow broad 
consent to secondary research use of 
biospecimens or identifiable private 
information for unspecified research 
purposes. Such broad consent would 
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have specified elements and limitations, 
and could have been obtained in both 
the research and nonresearch setting. 

The proposed exemption was 
specifically for secondary research 
studies involving biospecimens and 
identifiable private information that had 
been or would have been acquired for 
purposes other than the currently 
proposed research study. If a secondary 
research study did not meet the 
requirements of this exemption, the 
investigator would have needed to seek 
IRB review of the study, and would 
have needed to obtain either study- 
specific consent or a waiver of informed 
consent. Note that for biospecimens, an 
IRB would have applied the more 
stringent waiver criteria under which 
waiver of informed consent in research 
involving biospecimens would have 
been rare. For identifiable private 
information, an IRB would have applied 
the waiver criteria almost identical to 
the criteria in the pre-2018 rule. 

We anticipated that a majority of 
studies that would have used this 
exemption would have been 
biospecimen studies. The extent to 
which individuals conducting 
secondary research studies involving 
identifiable private information would 
have used this exemption is unknown, 
given the proposed rule provided 
additional pathways to facilitate such 
studies. To that end, the benefits and 
costs associated take into consideration 
only secondary research involving 
biospecimens. We further anticipated 
that the NPRM proposals would have 
resulted in higher value research with 
biospecimens being conducted with 
subjects’ consent and without the need 
for full IRB review, or the need to go 
back to subjects to obtain consent for 
every secondary research study, as long 
as certain conditions were met. 

Because the estimated 250,000 
biospecimen studies each year that 
would have been newly covered under 
the rule as a result of the proposed 
modification to the definition of human 
subject would likely have been minimal 
risk, we assume that all of these would 
have been eligible for the exemption for 
secondary use as long as broad consent 
had been sought and obtained. 

Benefits and costs associated with 
obtaining and tracking broad consent 
under this alternative proposal are 
discussed below. 

Because the compliance date for the 
expansion to the definition of human 
subject would have been 3 years after 
the date of publication of a final rule, 
the benefits and costs described below 
assume a start date of 2020. In the 
absence of the proposed exemption for 
secondary research studies, but taking 


into consideration the expansion to the 
definition of human subject, we 
estimate that each year, all 250,000 of 
these studies would undergo convened 
initial review. In subsequent years, we 
estimate that 120,000 protocols would 
undergo convened initial review, 89,700 
would undergo convened continuing 
review, and 40,300 would undergo 
expedited continuing review based on 
the distribution of reviews presented in 
Table 3. The estimated costs to 
institution officials, IRB administrators, 
IRB administrative staff, IRB chairs, IRB 
voting members, and investigators 
conducting these reviews are based on 
the estimates presented in Table 3. The 
dollar value of their time is calculated 
by multiplying hours by their estimated 
2017-2026 wages and adjusting for 
overhead and benefits. 


c. Facilitating Research With 
Nonidentified Biospecimens Under the 
NPRM: Seeking and Obtaining Broad 
Consent 


To facilitate secondary research using 
biospecimens and identifiable private 
information, the NPRM also proposed 
an exemption for storing and 
maintaining biospecimens and 
identifiable private information for 
future, unspecified, secondary research 
activities. Given the creation of this 
exemption, the NPRM envisioned that 
institutions would need to develop 
tracking systems to monitor which 
biospecimens or information could be 
used in secondary research by 
investigators. Because both the 
exemption for secondary research use 
described above, and the exemption 
required using the proposed Secretary’s 
broad consent, the NPRM assumed that 
a majority of investigators and 
institutions would employ the 
Secretary’s consent template. Thus, the 
NPRM anticipated that minimal time 
would have been spent updating 
consent forms or drafting new broad 
consent forms. 

We estimate that 6,428 FWA-holding 
institutions (80 percent) would have 
stored and maintained clinical and 
nonclinical biospecimens and 
identifiable private information for 
unspecified future research studies in 
the manner prescribed under the NPRM. 
As also discussed previously, 
extrapolations from 1999 data suggest 
that biospecimens are collected from as 
many as 30 million individuals each 
year and stored for both clinical and 
research purposes. Approximately 9 
million individuals’ biospecimens (30 
percent) are collected for research 
purposes, and thus consent would be 
sought in the research context for the 
secondary use of these biospecimens. 


For these 9 million individuals per year, 
an investigator would spend an 
estimated 20 minutes per person 
conducting the consent process specific 
to seeking broad consent, and the 
subjects would spend an estimated 20 
minutes engaging in the process of 
having their broad consent for future 
research uses of their biospecimens or 
information sought. This estimate of the 
investigator’s time also includes the 
time for the investigator to log the 
information into the appropriate 
database. We note that the NPRM RIA 
estimated that it would take 5 minutes 
for an investigator to seek broad consent 
in the research setting, and that 
prospective subjects would spend 5 
minutes having their broad consent 
sought. Based on public comments, we 
have revised this estimate to better 
reflect experience in the regulated 
community about how long it takes to 
seek and obtain consent. We further 
estimate that investigators would spend 
10 minutes of time per protocol 
updating their study specific consent 
form to include the language from the 
Secretary’s consent template. 

In the clinical setting, approximately 
21 million individuals’ biospecimens 
(70 percent of the estimated 30 million 
individuals’ biospecimens collected 
each year) are collected for clinical 
purposes. In the first year that the 
proposed changes would have been 
implemented, as many as 21 million 
broad, secondary use consent forms 
could have been collected from 
individuals. We anticipate 30 minutes 
of a subject’s time to engage in the 
consent process. We further anticipate 
30 minutes of an institutional 
employee’s time at the IRB 
Administrative Staff level to seek 
consent and put the information in the 
appropriate tracking system. As with the 
estimate for seeking and obtaining broad 
consent in the clinical setting, we have 
increased the estimate of how long it 
would take institutional employees to 
seek broad consent and how long 
prospective subjects would spend 
participating in the broad consent 
process based on public comments. 

The NPRM proposed that once an 
individual gave broad consent to use his 
or her biospecimens in future, 
unspecified research studies, that 
consent could cover any biospecimen 
collected from that individual over the 
course of a 10-year period. Note that an 
institution could retain and use the 
biospecimens collected indefinitely. 
This provision merely stated that every 
10 years an institution must ask people 
whether or not they may use newly 
collected biospecimens in research. 
Given that an institution needed to seek 
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broad consent from an individual only 
once over the course of a 10-year period, 
we assumed that after the first year the 
NPRM was implemented, the number of 
individuals from whom an institution 
would seek broad consent would 
decrease. 


To account for this, the RIA 
alternative approach assumes that after 
the first year, a fraction of the clinical 
subjects from whom broad consent was 
sought in year one would be sought in 
subsequent years. We anticipate that in 
year two, secondary use consent would 
be sought in the clinical context from 
10.5 million subjects (50 percent of the 
number of individuals involved in the 
year one estimates). We anticipate that 
in year three and after, secondary use 
consent would be sought in the clinical 
context from approximately 6.3 million 
subjects each year (30 percent of the 
number of individuals involved in the 
year one estimates). As in year one, we 
assume that a prospective subject would 
spend 30 minutes of time undergoing 
the consent process and that an 
institutional employee at the IRB 
Administrative Staff level would spend 
30 minutes of time conducting the 
consent process with an individual and 


updating the appropriate tracking 
system. 


d. Estimating the Cost of the Broad 
Consent Tracking System 


To appropriately track biospecimens 
or identifiable private information for 
which broad consent had been sought 
and obtained on an institutional level, 
an institution would need to develop an 
institution-wide repository-like schema. 
The costs include the design, 
implementation, and operation of the 
informatics system that would be 
required to document and keep current 
thousands of consent documents per 
year. In addition, the institution would 
have to come up with a system to mark 
or otherwise flag which biospecimens 
and pieces of identifiable private 
information could be used in future 
unspecified secondary research studies. 

Under the NPRM proposal, we 
estimate that 80 percent of the 8,035 
institutions with FWAs would develop 
these informatics systems (or modify 
existing systems) to facilitate research 
with nonidentified biospecimens. We 
estimate that under this proposal, 
institutions on average would require 
1.0 database administrator FTE to 
develop and maintain these systems. We 
note that as this estimate is a 


nationwide average, and we expect 
some institutions would require more 
database administrators, and others 
would require fewer. 


For all of the estimates described 
above, the estimated costs to institution 
officials, IRB administrators, IRB 
administrative staff, IRB chairs, IRB 
voting members, database 
administrators, and investigators of are 
based on the estimates presented in 
Table 3. The dollar value of their time 
is calculated by multiplying hours by 
their estimated 2017-2026 wages and 
adjusting for overhead and benefits. 


For the alternative proposal (i.e., the 
NPRM proposal to treat all 
biospecimens regardless of 
identifiability as covered under the 
Common Rule), present value costs of 
$19.7 billion and annualized costs of 
$2.31 billion are estimated using a 3 
percent discount rate; and present value 
costs of $14.2 billion and annualized 
costs of $2.02 billion are estimated 
using a 7 percent discount rate. Table 20 
summarizes the quantified and 
nonquantified benefits and costs of 
amending the definition of human 
subject and obtaining consent to 
secondary use of biospecimens and 
identifiable private information. 


TABLE 20—ALTERNATIVE PROPOSAL TO TREAT ALL BIOSPECIMENS AS COVERED UNDER THE COMMON RULE 



































Present value of 10 Annualized value over 10 
years by discount rate years by discount rate 
(millions of 2015 dollars) (millions of 2015 dollars) 
3 percent 7 percent 3 percent 7 percent 
BENEFITS: 
Quantified Benefits: 
INQVV Caio sxtr0sh Sef ans eevee ape tee altos Se ei ea at eBags tev tales Dosen eRe NOt vised desde ede | okanagan Set aecxSstdde diel tegteeucde sae dtaseasueeteei|| event etdecPadhesteteasnt,| Atueseabtvace yeuctersdts 
Nonquantified Benefits: 
Increased protections for human subjects. 
COSTS: 
Quantified Costs: 
Increase in number of reviews; time to update consent forms; docu- 
ment and track permissible and impermissible secondary uses of in- 
formation and biospecimens; and cost to develop and maintain track- 
ING: SYSlOM | 3. seivcene etka teA wee tee tiene ec 19,670 14,214 2,306 2,024 











Nonquantified Costs: 
None. 





F. Regulatory Flexibility Analysis 


As discussed above, the RFA requires 
agencies that issue a regulation to 
analyze options for regulatory relief of 
small entities if a rule has a significant 
impact on a substantial number of small 
entities. HHS considers a rule to have a 
significant economic impact on a 
substantial number of small entities if at 
least 5 percent of small entities 


experience an impact of more than 3 
percent of revenue. 


We calculate the costs of the proposed 
changes to the Common Rule over 
2017-2026 to institutions with an FWA. 
The estimated annualized cost to 
institutions with an FWA, on average, is 
$2,516 using a 3 percent discount rate. 
The U.S. Small Business Administration 
establishes size standards that define a 
small entity. According to these 


standards, colleges, universities, and 
professional schools with revenues 
below $27.5 million and hospitals with 
revenues below $38.5 million are 
considered small entities. It is not 
anticipated that a majority of 
institutions with an FWA are in any of 
these categories. 
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XX. Environmental Impact 


We have determined under 21 CFR 
25.30(k) that this action is of a type that 
does not individually or cumulatively 
have a significant effect on the human 
environment. Therefore, neither an 
environmental assessment nor an 
environmental impact statement is 
required. 


XXI. Paperwork Reduction Analysis 


This final rule contains collections of 
information that are subject to review 
and approval by the Office of 
Management and Budget (OMB) under 
the Paperwork Reduction Act (PRA), as 
amended (44 U.S.C. 3501-3520). A 
description of these provisions is given 
in this document with an estimate of the 
annual reporting and recordkeeping 
burden. 

Title: Federal Policy for the Protection 
of Human Subjects. 

Description: In this document is a 
discussion of the regulatory provisions 
we believe are subject to the PRA and 
the probable information collection 
burden associated with these 
provisions. In general, the following 
actions trigger the PRA: (i) Reporting; 
(ii) Recordkeeping. 

Description of Respondents: The 
reporting and recordkeeping 
requirements in this document are 
imposed on institutions, institutional 
review boards, and investigators 
involved in human subjects research 
conducted or supported or otherwise 
subject to regulation by any federal 
department or agency that takes 
administrative action that makes the 
policy applicable to such research. 


§ _.101(a)(1)_ Extending Oversight to 
IRBs-Not Operated by an Institution 
Holding an FWA (OMB Control No 
0990-0260) 


Section _.101 is amended, as 
describedin§ _.101(a), to give 
Common Rule departments and 
agencies the authority to enforce 
compliance directly against IRBs that, 
are not operated by an assured 
institution. It is anticipated that 
institutions using an IRB that it does not 
operate will be reassured because 
compliance actions can be taken 
directly against the IRB responsible for 
the regulatory noncompliance, rather 
than the institutions that relied on that 
review. As a result of this change, we 
anticipate that FWA-holding 
institutions will increase their reliance 
on IRBs not operated by an FWA- 
holding institution when appropriate. 

The OHRP database of assured 
institutions and registered IRBs shows 
that approximately 449 IRBs not 


operated by an institution holding an 
FWA will now be subject to oversight. 
These IRBs will develop an estimated 
average of 10 written agreements with 
other institutions each year as a result 
of this rule. We further estimate that 
each agreement will require an average 
of 10 hours of institution legal staff time 
and 5 hours of IRB administrator time 
to complete. We note that elsewhere in 
the final rule (specifically §§ _.103(e) 
and ___.115(a)(9)) requires that IRBs 
document the specific responsibilities 
that an institution and an organization 
operating an IRB each will undertake, 
when an institution relies on an IRB that 
it does not operate. The impact of these 
provisions on FWA-holding institutions 
is described below. 


§ ___.103(e) Documentation of IRB 
Oversight Reliance Requirement for 
Institution and Organization Operating 
the IRB (OMB Control No 0990-0260) 


To further strengthen the compliance 
enforcement authority provision in 
§ _.101(a) and provide a record for 
oversight and compliance purposes, the 
final rule contains a requirement at 
§ _.103(e), that for nonexempt 
research involving human subjects 
covered by this policy (or exempt 
research for which limited IRB takes 
place pursuant to § .104(d)(2) (iii), 
§ _.104(d)(3)@)(C), §__.104(d)(7), 
or § .104(d)(8)) that take place at an 
institution in which IRB oversight is 
conducted by an IRB that is not 
operated by the institution, the 
institution and the organization 
operating the IRB shall document the 
institution’s reliance on the IRB for 
oversight of the research and the 
responsibilities that each entity will 
undertake to ensure compliance with 
the requirements of this policy. This 
might be accomplished through a 
written agreement between the 
institution and the IRB, or by 
implementing an institution-wide 
policy directive providing the allocation 
of responsibilities between the 
institution and an IRB that is not 
affiliated with the institution, or as set 
forth in a research protocol). In 
addition, a requirement is included at 
§ _.115(a)(9) that an institution 
include documentation of such 
arrangements in the IRB records. 

Table 3 of the RIA section of the 
preamble shows that 5,164 FWA- 
holding institutions do not have an IRB 
and 2,871 FWA-holding institutions 
have an IRB. We assume that the 5,164 
FWA-holding institutions without an 
IRB have an average of 1 IRB 
authorization agreement that will need 
to be modified as a result of the new 
requirements for agreements between 








institutions and IRBs not operated by 
the institutions in 2017. In addition, we 
assume that the 2,871 FWA-holding 
institutions with an IRB have an average 
of 0.20 IRB authorization agreements 
that will need to be modified in 2017. 
We estimate that each agreement will 
require an average of 10 hours of 
institution legal staff time and 5 hours 
of IRB administrator time to complete. 
The dollar value of their time is 
calculated by multiplying hours by their 
estimated 2017 wages and adjusting for 
overhead and benefits. 


§ .104(d)(5)(i) Posting of 
Information About Federally Funded or 
Supported Demonstration Projects 


Section 104(d)(5)(i) requires each 
federal department or agency 
conducting or supporting the research 
or demonstration projects covered under 
this exemption to establish, on a 
publicly accessible federal Web site or 
in such other manner as the department 
or agency head may determine, a list of 
the research and demonstration projects 
that the federal department or agency 
conducts or supports under this 
provision. We estimate that under the 
pre-2018 rule, approximately 1,000 
demonstration projects occurred each 
year. Under the modifications to this 
exemption in the final rule, we estimate 
that an additional 3,376 studies will fall 
under this exemption. Thus, 
approximately 4,376 studies will be 
subject to this posting requirement each 
year. We anticipate that investigators 
will spend approximately 15 minutes 
per study submitting information about 
these studies to the federal Web site. 


§ .114 Cooperative Research (OMB 
Control No 0990-0260) 


The final rule requires any institution 
located in the United States that is 
engaged in cooperative research to rely 
upon approval by a single IRB for that 
portion of the research that is conducted 
in the United States, as detailed in 
§ _.114 (b)(1). The following research 
is not subject to the requirements of this 
provision, as described in § _—.114 
(b)(2): (1) Cooperative research for 
which more than single IRB review is 
required by law (including tribal law 
passed by the official governing body of 
a Native American or Alaska Native 
tribe); or (2) research for which any 
federal department or agency supporting 
or conducting the research determines 
and documents that the use of a single 
IRB is not appropriate for the particular 
study. 

The OHRP database of assurances 
shows that 8,035 institutions in the 
United States have an FWA. We 
estimate that these institutions will 
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develop an average of 10 written joint 
IRB review agreements with other 
institutions or organizations in 2019 
before the first year of compliance. We 
further estimate that each agreement 
will require an average of 10 hours of 
institution legal staff time and 5 hours 
of IRB administrator time to complete. 

We estimate that 202,617 annual 
reviews of multi-institutional protocols 
take place, and an average of 5 reviews 
per multi-institutional protocol, 
implying that 40,523 multi-institutional 
protocols are reviewed each year. We 
further estimate that 16,209 (40 percent) 
of these multi-institutional studies are 
funded by NIH and thus will already be 
subject to NIH’s single IRB review 
policy. Accordingly, we estimate that 
approximately 97,256 annual reviews of 
protocols will no longer be conducted as 
a result of these proposed changes. Of 
these reviews, 32,211 would have 
undergone convened initial review, 
14,472 would have undergone 
expedited initial review, 34,896 would 
have undergone convened continuing 
review, and 15,678 would have 
undergone expedited continuing review 
based on the distribution of reviews 
presented in Table 3 in the RIA section 
of the preamble. 


§__.115(a}(3) Documenting the 
Rationale for Conducting Continuing 
Review of Research That Otherwise 
Would Not Require Continuing 
Review(OMB Control No 0990-0260) 


The final rule eliminates continuing 
review for many minimal risk studies, 
as detailed at§ _—_—«.109(f). Unless an 
IRB determines otherwise, continuing 
review of research is not required if: (1) 
The research is eligible for expedited 
review in accordance with § _.110; 
(2) the research is reviewed by the IRB 
in accordance with the limited IRB 
review procedure described in several of 
the exemption categories (specifically, 
§ _.104(d)(2)(iii), 
§___.104(d)(3)(@)(C), §__—--104(d)(7), 
or § _.104(d)(8)); or (3) the research 
has progressed to the point that it 
involves data analysis (including 
analysis of identifiable information or 
identifiable biospecimens) or access to 
follow-up clinical data from procedures 
that subjects would undergo as part of 
clinical care. If an IRB chooses to 
conduct continuing review even when 
these conditions are met, the rationale 
for doing so must be documented 
according to a new provision at 
§ _.115(a)(3). 

We estimate that 40,773 reviews will 
require documentation of the rationale 
for doing so (as required under 
§ _.115(a)(3)). We also estimate that 
IRB voting members will spend 1 hour 


per review providing the necessary 
documentation. 


§§___.116(a)(5), (b)(9), (c)(7)-(9) and 
____.117(b) Changes in the Elements of 
Consent, Including Documentation 
(OMB Control No 0990-0260) 


The final rule imposes a new 
requirement at § —_—.116(a)(5)(i) 
informed consent must begin with a 
concise and focused presentation of the 
key information that is most likely to 
assist a prospective subject or legally 
authorized representative in 
understanding the reasons why one 
might or might not want to participate 
in the research. This part of informed 
consent must be organized and 
presented in a way that facilitates 
comprehension. This requirement 
applies to all informed consent process, 
except for broad consent obtained 
pursuant to§ —_—.116(d), which may 
warrant a different presentation. 

The final rule includes a new element 
of consent at § —_.116(b)(9) that 
requires one of the following statements 
be included for any research that 
involves the collection of identifiable 
private information or identifiable 
biospecimens: (1) A statement that 
identifiers might be removed from the 
identifiable private information or 
identifiable biospecimens and that after 
such removal, the information or 
biospecimens could be used for future 
research studies or distributed to 
another investigator for future research 
studies without additional informed 
consent from the subject or the legally 
authorized representative, if this might 
be a possibility; or (2) a statement that 
the subject’s information or 
biospecimens collected as part of the 
research, even if identifiers are 
removed, will not be used or distributed 
for future research studies. 

The final rule’s three additional 
elements of consent are in 
§ _.116(c)(7), (8), and (9). These 
require that a subject be informed of the 
following, when appropriate: 

e That the subject’s biospecimens 
(even if identifiers are removed) may be 
used for commercial profit and whether 
the subject will or will not share in this 
commercial profit; 

e Whether clinically relevant research 
results, including individual research 
results, will be disclosed to subjects, 
and if so, under what conditions; 

e For research involving 
biospecimens, whether the research will 
(if known) or might include whole 
genome sequencing (i.e., sequencing of 
a human germline or somatic specimen 
with the intent to generate the genome 
or exome sequence of that specimen. 


These additional elements of consent 
will promote respect for persons and 
greater transparency in the research 
enterprise. Additionally, including the 
information referenced in these 
provisions in a consent form will help 
ensure that prospective subjects are 
given information necessary for 
understanding why one might choose 
whether to participate in a research 
study. 

The language at§ —_—.117(b)(1) in the 
final rule was modified to reference 
§ _.116(a)(5)(i) and state that if a 
short form consent process is used, the 
key information required by 
§ .116(a)(5)(i) must be presented 
first to the prospective subject, before 
other information, if any, is provided. 

We estimate that 246,382 new 
protocols annually will use identifiable 
private information. For each protocol, 
we estimate that investigators will 
spend an average of 15 minutes in 2017 
updating consent forms to comply with 
the new requirements found in the final 
rule at § —_.116(a)(5), (b)(9), (c)(7), 
(c)(8), or (c)(9) (in Table 3 in the RIA 
section). 

We assume that few additional 
investigators will elect to offer the 
second option at § _.116(b)(9), and 
that the investigators who currently 
offer equivalent options already track 
the permissible and impermissible uses 
of information in line with the 
requirements discussed above. As a 
result, we estimate that tracking will 
have no additional associated impacts. 


§___.116(h) Requirement for Posting 
of Consent Forms for Common Rule 
Department or Agency-Supported or 
Conducted Clinical Trials (OMB Control 
No 0990-0260) 


A new provision in the final rule, 

§ .116(h), requires that, for each 
clinical trial conducted or supported by 
a federal department or agency, one IRB- 
approved informed consent form used 
to enroll subjects must be posted by the 
awardee or federal department or 
agency component conducting the trial 
on a publicly available federal Web site 
that is established as a repository for 
such informed consent forms. The 
informed consent form must be 
published on the federal Web site after 
the trial is closed to recruitment, and no 
later than 60 days after the last study 
visit by any subject, as required by the 
protocol. 

If the federal department or agency 
supporting or conducting the clinical 
trial determines that certain information 
should not be made publicly available 
on a federal Web site (e.g., confidential 
commercial information), such Federal 
department or agency may permit or 
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require redactions to the information 
posted. 

We believe that public posting of 
consent forms will increase 
transparency, enhance confidence in the 
research enterprise, increase 
accountability, and inform the 
development of future consent forms, 
possibly resulting in future savings in 
time for investigators developing 
consent forms. 


According to queries of 
ClinicalTrials.gov, an estimated 5,270 
clinical trials are conducted or 
supported by Common Rule agencies, of 
which an estimated 575 are regulated by 
provisions in the FD&C Act and Trade 
Secrets Act based on the information 
presented in Table 3 in the RIA section 
of the preamble. We assume that each 
clinical trial is associated with one 
consent form that must be submitted to 


the HHS system by an investigator. We 
estimate that investigators will spend an 
average of 15 minutes submitting each 
consent form. In addition, for the 575 
clinical trials regulated by provisions in 
the FD&C Act and Trade Secrets Act, we 
estimate that investigators will spend an 
average of 30 minutes redacting 
information before submission. 


TABLE 21—ESTIMATED ANNUAL REPORTING BURDEN 











Number of 
na + aa Number of Total annual | Average hours 
Sec. description Description of burden respondents responses per responses per roeponae Total hours 
respondent 
101(a)—Extending Over- Develop agreements .......... 449 10 4,490 15 67,350 
sight Authority to IRBs 
not operated by an FWA- 
holding institution. 
103(e)—IRB Reliance Doc- | Modify agreements ............. 5,164 1 5,164 15 77,460 
umentation (institutions 
without an internal IRB). 
103(e)—IRB Reliance Doc- | Develop agreements .......... 2,871 0.20 574.20 15 8,613 
umentation (institutions 
with an internal IRB). 
104(d)(5)(i)—Posting infor- Posting information ............ 4,376 1 4,376 0.25 1,094 
mation about demonstra- 
tion projects. 
114—-Cooperative Review .. | Time to create agreements 8,035 10 80,350 15 1,205,250 
for all institutions involved 
in a study will rely on one 
IRB of record. 
115(a)(3)—Continuing Re- Provide rationale ............... 40,773 1 40,773 1 40,773 
view Rationale Docu- 
mentation. 
116(a)(5), (b)(9), (c)(7)-(8) Updating IC forms with new 246,382 1 246,382 0.25 61,596 
& 117(b)—Changes in elements. 
elements of informed con- 
sent, including docu- 
mentation. 
116(h)—Requirement for Posting consent forms for 5,270 1 5,270 0.25 1,318 
posting consent forms for new Clinical trials. 
Common Rule depart- 
ment or agency-sup- 
ported clinical trials. 
116(h)—Requirement for Redact information from 575 1 575 0.50 288 
posting consent forms for consent forms. 
Common Rule depart- 
ment or agency-sup- 
ported clinical trials. 
Total hte ovivewetiees | on dinates italy | Geer nak ce cies 5 Battie ik eae | one re eca | cae a atta 1,422,968 























The total estimated burden imposed 
by these information collection 
requirements is 1,422,968 burden hours. 


It should be noted that the burden 
estimates for the Common Rule include 
approved information requirements in 
OMB No. 0990-0260, Protection of 
Human Subjects: Compliance with 
Federal Policy/IRB Recordkeeping/ 
Informed Consent/Consent 
Documentation, approved through May 
31, 2018. As such, it will be amended 
and submitted to OMB as revisions to 
currently approved collections once the 


rule is finalized and the collections are 
due for renewal. 

In compliance with the Paperwork 
Reduction Act of 1995 (44 U.S.C. 
3507(d)), the information collection 
provisions of this rule will be submitted 
to OMB for review. These requirements 
will not be effective until OMB 
approves them. 


XXII. Tribal Consultation Statement 
We are committed to consulting with 
AI/AN tribes and tribal leadership to the 
extent practicable and permitted by law 


before promulgating any regulation that 
has tribal implications. As we 


developed this rule, we engaged with 
tribes through tribal consultation and 
the public comment process. The 
requirements in this final rule were 
informed by consultations with and 
comments from tribal representatives. 
On January 5, 2016, HHS conducted 
a tribal consultation through conference 
call in accordance with the HHS Tribal 
Consultation Policy ® with tribal 
representatives to obtain comments on 


61U.S. Department of Health and Human Services 
Tribal Consultation Policy. Retrieved from https:// 
www.hhs.gov/sites/default/files/iea/tribal/ 
tribalconsultation/hhs-consultation-policy.pdf. 
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the proposed changes to the Common 
Rule. This conference call was 
moderated by Elizabeth Carr, a Tribal 
Affairs Specialist within HHS and a 
federal representative of HHS’s 
American Indian and Alaska Native 
Health Research Advisory Council. 
Tribal leaders and other interested 
parties were informed of this 
consultation through written 
communication. The written invitation 
included a solicitation for formal 
comments and information on how to 
submit a formal comment to the public 
docket. Public comments were also 
solicited during the consultation 
conference call. A transcript of this call 
was posted to the Regulations.gov 
public docket for the Common Rule on 
January 13, 2016. 

During the tribal consultation 
conference call, participants discussed: 

e Concern about the NPRM not 
acknowledging the role of tribal 
governments in research oversight of 
research occurring on tribal land or with 
tribal citizens; 

e Concern about the pre-2018 rule 
and the NPRM not explicitly 
acknowledging tribal sovereignty. HHS 
representatives acknowledged an 
outstanding legal question about 
whether rules created by tribal 
governments were encompassed by the 
provision in the pre-2018 rule and the 
NPRM’s statement that the policy does 
not affect any state or local laws or 
regulations that may otherwise be 
applicable and that provide additional 
protections for human subjects; 

e Concern about the NPRM not 
acknowledging the unique and 
significant impact that the proposed 
changes would have on American 
Indian and Alaska Native populations; 

e Concern that the NPRM does not 
address risks of research to communities 
and only addresses individual risks; 

e Concern that the NPRM proposals 
seem to reduce institutional 
responsibility but increase investigator 
responsibility. This presents a unique 
challenge when institutions have 
entered into agreements with tribal 
governments or tribal representatives, as 
opposed to individual investigators 
entering into these arrangements. The 
exemption decision tool was cited as an 
example of the proposals placing more 
responsibility on the investigators while 
perhaps reducing responsibility on the 
institutions; and 

e Concern about the single IRB 
review mandate for multi-institutional 
studies affecting the ability of tribal 
communities to conduct local reviews of 
research involving tribal citizens or 
research that takes place on tribal land. 
One commenter noted that a one size 


fits all approach to addressing American 
Indian and Alaska Native concerns in 
human subjects protections might not be 
appropriate as needs and concerns 
might vary from tribe to tribe. 

HHS reiterated its commitment to 
engaging in an ongoing dialogue with 
tribal communities and tribal 
representatives, and welcomed ongoing 
discussion and comment on how the 
Common Rule affects these groups. 

In addition to the January 2016 tribal 
consultation, we reviewed public 
comments from tribal representatives, 
and individuals and groups representing 
tribal interests to the ANPRM and 
NPRM. We received one comment on 
the ANPRM from a group representing 
tribal interests. This group noted “‘the 
long and challenging history”’ of 
research involving AI/AN populations, 
and how this history informs current 
research activities involving these 
groups. This comment argued that, for 
research involving AI/AN populations: 

e Continuing review should be 
required; 

e IRBs, not investigators or other 
parties, should determine whether a 
prospective study is exempt or excluded 
from the Common Rule; 

e IRBs should be required to consider 
potential harms to populations or 
groups, not just individuals, when 
reviewing research activities; 

e Incorporating tribal IRBs into the 
process for multi-institutional studies is 
a crucial aspect of respecting these 
populations and ensuring human 
subjects protections; 

e Study-specific informed consent 
forms should be required, and general, 
multi-purpose consent forms should be 
avoided; 

e Mandated information and 
biospecimen privacy safeguards would 
be a welcome improvement to the 
current research landscape and would 
help prevent harm to human subjects; 
and 

e Consultation with tribal 
representatives would be crucial should 
a proposed rule or final rule mandate 
single IRB review for multi-institutional 
studies. 

We received approximately 15 
comments on the NPRM from groups 
representing tribal interests. As 
described in Section ILE of this 
preamble, overarching concerns raised 
by these groups in comments to the 
NPRM included: 

e Lack of group consent requirements 
proposed in the NPRM; 

e Concern about the allowance for 
broad consent for future unspecified 
research uses; 

e Lack of consideration for research 
activities involving research with 


biospecimens or information from 
individuals who are no longer alive; 

e Mandating the use of single IRB 
review in multi-institutional research 
activities undermining the ability of 
tribal groups to conduct local review of 
studies; and 

e Concern about the breadth and 
depth of exclusions and exemptions 
proposed in the NPRM exempting or 
excluding activities that tribal 
populations might find sensitive and 
requiring IRB review. 

Commenters also raised concerns 
about the timing of the tribal 
consultation call and noted that the 
tribal consultation call occurred one day 
before the closing of the extended 
comment period for the NPRM. When 
HHS received notice that tribal 
representatives desired to consult on 
this proposed rule, a consultation was 
immediately scheduled in accordance 
with HHS policy. 

The final rule includes a modification 
to the provision requiring single IRB 
review, and several clarifications 
specifying that regulatory references to 
state and local law are intended to 
include tribal law, in response to 
concerns raised during the tribal 
consultation and in the NPRM public 
comments. As described in this 
preamble, the final rule clarifies in 
§ _.101(f) that tribal governments can 
develop laws related to the protection of 
human subjects that are more protective 
than the Common Rule, and that these 
laws must be followed by federally 
funded researches in activities involving 
these populations. Section __—.114 now 
provides that if a tribal government 
requires review by more than one IRB 
by law in multi-institutional research, 
the single IRB review requirement in 
§ .114 does not apply. Additional 
clarification has also been made to 
§ .116(i) that tribal governments can 
develop their own informed consent 
standards that provide additional 
protections to subjects and that 
investigators conducting research 
involving populations under the 
jurisdiction of the tribal governments 
would have to follow these rules. 
Finally, additional language has been 
addedto§ _.116(j) noting that 
nothingin§ _.116 is intended to 
limit the authority of a treating 
physician to the extent the authority is 
granted by tribal law. 

Additional details of public 
comments from individuals 
representing tribal interests are included 
above in the relevant public comment 
summaries for the various final rule 
provisions discussed in Sections II 
through XVIII of this preamble. 








Federal Register/Vol. 82, No. 12/Thursday, January 19, 2017/Rules and Regulations 


7259 








For the reasons set forth in this 
preamble, the Federal Policy for the 
Protection of Human Subjects is 
amended. 


Text of the Final Common Rule 


The text of the final common rule 
appears below: 

1. Part/subpart __ is amended/ 
revised/added to read as follows: 


PART —PROTECTION OF HUMAN 


SUBJECTS 


___.101 To what does this policy apply? 

____.102 Definitions for purposes of this 
policy. 

____.103 Assuring compliance with this 
policy—research conducted or supported 
by any Federal department or agency. 

___.104 Exempt research. 

__.105 [Reserved] 

__.106 [Reserved] 

____.107 IRB membership. 

____.108 IRB functions and operations. 

__.109 IRB review of research. 

___.110 Expedited review procedures for 
certain kinds of research involving no 
more than minimal risk, and for minor 
changes in approved research. 

___.111 Criteria for IRB approval of 
research. 

___.112 Review by institution. 

____.113 Suspension or termination of IRB 
approval of research. 

____.114 Cooperative research. 

___.115 IRB records. 

____.116 General requirements for informed 
consent. 

___.117 Documentation of informed 
consent. 

____.118 Applications and proposals 
lacking definite plans for involvement of 
human subjects. 

__.119 Research undertaken without the 
intention of involving human subjects. 

__.120 Evaluation and disposition of 
applications and proposals for research 
to be conducted or supported by a 
Federal department or agency. 

__.121 [Reserved] 

____.122 Use of Federal funds. 

____.123 Early termination of research 
support: Evaluation of applications and 
proposals. 

__.124 Conditions. 


§ _.101 To what does this policy 
apply? 

(a) Except as detailed in § _—.104, 
this policy applies to all research 
involving human subjects conducted, 
supported, or otherwise subject to 
regulation by any Federal department or 
agency that takes appropriate 
administrative action to make the policy 
applicable to such research. This 
includes research conducted by Federal 
civilian employees or military 
personnel, except that each department 
or agency head may adopt such 
procedural modifications as may be 
appropriate from an administrative 
standpoint. It also includes research 


conducted, supported, or otherwise 
subject to regulation by the Federal 
Government outside the United States. 
Institutions that are engaged in research 
described in this paragraph and 
institutional review boards (IRBs) 
reviewing research that is subject to this 
policy must comply with this policy. 

(b) [Reserved] 

(c) Department or agency heads retain 
final judgment as to whether a 
particular activity is covered by this 
policy and this judgment shall be 
exercised consistent with the ethical 
principles of the Belmont Report.62 

(d) Department or agency heads may 
require that specific research activities 
or classes of research activities 
conducted, supported, or otherwise 
subject to regulation by the Federal 
department or agency but not otherwise 
covered by this policy comply with 
some or all of the requirements of this 
policy. 

(e) Compliance with this policy 
requires compliance with pertinent 
federal laws or regulations that provide 
additional protections for human 
subjects. 

(f) This policy does not affect any 
state or local laws or regulations 
(including tribal law passed by the 
official governing body of an American 
Indian or Alaska Native tribe) that may 
otherwise be applicable and that 
provide additional protections for 
human subjects. 

(g) This policy does not affect any 
foreign laws or regulations that may 
otherwise be applicable and that 
provide additional protections to human 
subjects of research. 

(h) When research covered by this 
policy takes place in foreign countries, 
procedures normally followed in the 
foreign countries to protect human 
subjects may differ from those set forth 
in this policy. In these circumstances, if 
a department or agency head determines 
that the procedures prescribed by the 
institution afford protections that are at 
least equivalent to those provided in 
this policy, the department or agency 
head may approve the substitution of 
the foreign procedures in lieu of the 
procedural requirements provided in 
this policy. Except when otherwise 
required by statute, Executive Order, or 
the department or agency head, notices 
of these actions as they occur will be 
published in the Federal Register or 
will be otherwise published as provided 
in department or agency procedures. 

(i) Unless otherwise required by law, 
department or agency heads may waive 


62 The National Commission for the Protection of 
Human Subjects of Biomedical and Behavioral 
Research.— Belmont Report. Washington, DC: U.S. 
Department of Health and Human Services. 1979. 


the applicability of some or all of the 
provisions of this policy to specific 
research activities or classes of research 
activities otherwise covered by this 
policy, provided the alternative 
procedures to be followed are consistent 
with the principles of the Belmont 
Report.63 Except when otherwise 
required by statute or Executive Order, 
the department or agency head shall 
forward advance notices of these actions 
to the Office for Human Research 
Protections, Department of Health and 
Human Services (HHS), or any 
successor office, or to the equivalent 
office within the appropriate Federal 
department or agency, and shall also 
publish them in the Federal Register or 
in such other manner as provided in 
department or agency procedures. The 
waiver notice must include a statement 
that identifies the conditions under 
which the waiver will be applied and a 
justification as to why the waiver is 
appropriate for the research, including 
how the decision is consistent with the 
principles of the Belmont Report. 

(j) Federal guidance on the 
requirements of this policy shall be 
issued only after consultation, for the 
purpose of harmonization (to the extent 
appropriate), with other Federal 
departments and agencies that have 
adopted this policy, unless such 
consultation is not feasible. 

(k) [Reserved] 

(1) Compliance dates and transition 
provisions: 

(1) For purposes of this section, the 
pre-2018 Requirements means this 
subpart as published in the 2016 edition 
of the Code of Federal Regulations. 

(2) For purposes of this section, the 
2018 Requirements means the Federal 
Policy for the Protection of Human 
Subjects requirements contained in this 
subpart. The compliance date for 
§ _.114(b) (cooperative research) of 
the 2018 Requirements is January 20, 
2020. 

(3) Research initially approved by an 
IRB, for which such review was waived 
pursuant to § .101(i), or for which a 
determination was made that the 
research was exempt before January 19, 
2018, shall comply with the pre-2018 
Requirements, except that an institution 
engaged in such research on or after 
January 19, 2018, may instead comply 
with the 2018 Requirements if the 
institution determines that such ongoing 
research will comply with the 2018 
Requirements and an IRB documents 
such determination. 

(4) Research initially approved by an 
IRB, for which such review was waived 
pursuant to § _.101(i), or for which a 
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determination was made that the 
research was exempt on or after January 
19, 2018, shall comply with the 2018 
Requirements. 

(m) Severability: Any provision of this 
part held to be invalid or unenforceable 
by its terms, or as applied to any person 
or circumstance, shall be construed so 
as to continue to give maximum effect 
to the provision permitted by law, 
unless such holding shall be one of utter 
invalidity or unenforceability, in which 
event the provision shall be severable 
from this part and shall not affect the 
remainder thereof or the application of 
the provision to other persons not 
similarly situated or to other dissimilar 
circumstances. 


§ _.102 Definitions for purposes of 
this policy. 

(a) Certification means the official 
notification by the institution to the 
supporting Federal department or 
agency component, in accordance with 
the requirements of this policy, that a 
research project or activity involving 
human subjects has been reviewed and 
approved by an IRB in accordance with 
an approved assurance. 

(b) Clinical trial means a research 
study in which one or more human 
subjects are prospectively assigned to 
one or more interventions (which may 
include placebo or other control) to 
evaluate the effects of the interventions 
on biomedical or behavioral health- 
related outcomes. 

(c) Department or agency head means 
the head of any Federal department or 
agency, for example, the Secretary of 
HHS, and any other officer or employee 
of any Federal department or agency to 
whom the authority provided by these 
regulations to the department or agency 
head has been delegated. 

(d) Federal department or agency 
refers to a federal department or agency 
(the department or agency itself rather 
than its bureaus, offices or divisions) 
that takes appropriate administrative 
action to make this policy applicable to 
the research involving human subjects it 
conducts, supports, or otherwise 
regulates (e.g., the U.S. Department of 
Health and Human Services, the U.S. 
Department of Defense, or the Central 
Intelligence Agency). 

(e)(1) Human subject means a living 
individual about whom an investigator 
(whether professional or student) 
conducting research: 

(i) Obtains information or 
biospecimens through intervention or 
interaction with the individual, and 
uses, studies, or analyzes the 
information or biospecimens; or (ii) 
Obtains, uses, studies, analyzes, or 
generates identifiable private 


information or identifiable 
biospecimens. 

(2) Intervention includes both 
physical procedures by which 
information or biospecimens are 
gathered (e.g., venipuncture) and 
manipulations of the subject or the 
subject’s environment that are 
performed for research purposes. 

(3) Interaction includes 
communication or interpersonal contact 
between investigator and subject. 

(4) Private information includes 
information about behavior that occurs 
in a context in which an individual can 
reasonably expect that no observation or 
recording is taking place, and 
information that has been provided for 
specific purposes by an individual and 
that the individual can reasonably 
expect will not be made public (e.g., a 
medical record). 

(5) Identifiable private information is 
private information for which the 
identity of the subject is or may readily 
be ascertained by the investigator or 
associated with the information. 

(6) An identifiable biospecimen is a 
biospecimen for which the identity of 
the subject is or may readily be 
ascertained by the investigator or 
associated with the biospecimen. 

(7) Federal departments or agencies 
implementing this policy shall: 

(i) Upon consultation with 
appropriate experts (including experts 
in data matching and re-identification), 
reexamine the meaning of “identifiable 
private information,” as defined in 
paragraph (e)(5) of this section, and 
“identifiable biospecimen,” as defined 
in paragraph (e)(6) of this section. This 
reexamination shall take place within 1 
year and regularly thereafter (at least 
every 4 years). This process will be 
conducted by collaboration among the 
Federal departments and agencies 
implementing this policy. If appropriate 
and permitted by law, such Federal 
departments and agencies may alter the 
interpretation of these terms, including 
through the use of guidance. 

(ii) Upon consultation with 
appropriate experts, assess whether 
there are analytic technologies or 
techniques that should be considered by 
investigators to generate “‘identifiable 
private information,” as defined in 
paragraph (e)(5) of this section, or an 
“identifiable biospecimen,” as defined 
in paragraph (e)(6) of this section. This 
assessment shall take place within 1 
year and regularly thereafter (at least 
every 4 years). This process will be 
conducted by collaboration among the 
Federal departments and agencies 
implementing this policy. Any such 
technologies or techniques will be 
included on a list of technologies or 


techniques that produce identifiable 
private information or identifiable 
biospecimens. This list will be 
published in the Federal Register after 
notice and an opportunity for public 
comment. The Secretary, HHS, shall 
maintain the list on a publicly 
accessible Web site. 

(f) Institution means any public or 
private entity, or department or agency 
(including federal, state, and other 
agencies). 

(g) IRB means an institutional review 
board established in accord with and for 
the purposes expressed in this policy. 

(h) IRB approval means the 
determination of the IRB that the 
research has been reviewed and may be 
conducted at an institution within the 
constraints set forth by the IRB and by 
other institutional and federal 
requirements. 

i) Legally authorized representative 
means an individual or judicial or other 
body authorized under applicable law to 
consent on behalf of a prospective 
subject to the subject’s participation in 
the procedure(s) involved in the 
research. If there is no applicable law 
addressing this issue, legally authorized 
representative means an individual 
recognized by institutional policy as 
acceptable for providing consent in the 
nonresearch context on behalf of the 
prospective subject to the subject’s 
participation in the procedure(s) 
involved in the research. 

(j) Minimal risk means that the 
probability and magnitude of harm or 
discomfort anticipated in the research 
are not greater in and of themselves than 
those ordinarily encountered in daily 
life or during the performance of routine 
physical or psychological examinations 
or tests. 

(k) Public health authority means an 
agency or authority of the United States, 
a state, a territory, a political 
subdivision of a state or territory, an 
Indian tribe, or a foreign government, or 
a person or entity acting under a grant 
of authority from or contract with such 
public agency, including the employees 
or agents of such public agency or its 
contractors or persons or entities to 
whom it has granted authority, that is 
responsible for public health matters as 
part of its official mandate. 

(1) Research means a systematic 
investigation, including research 
development, testing, and evaluation, 
designed to develop or contribute to 
generalizable knowledge. Activities that 
meet this definition constitute research 
for purposes of this policy, whether or 
not they are conducted or supported 
under a program that is considered 
research for other purposes. For 
example, some demonstration and 
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service programs may include research 
activities. For purposes of this part, the 
following activities are deemed not to be 
research: 

(1) Scholarly and journalistic 
activities (e.g., oral history, journalism, 
biography, literary criticism, legal 
research, and historical scholarship), 
including the collection and use of 
information, that focus directly on the 
specific individuals about whom the 
information is collected. 

(2) Public health surveillance 
activities, including the collection and 
testing of information or biospecimens, 
conducted, supported, requested, 
ordered, required, or authorized by a 
public health authority. Such activities 
are limited to those necessary to allow 
a public health authority to identify, 
monitor, assess, or investigate potential 
public health signals, onsets of disease 
outbreaks, or conditions of public health 
importance (including trends, signals, 
risk factors, patterns in diseases, or 
increases in injuries from using 
consumer products). Such activities 
include those associated with providing 
timely situational awareness and 
priority setting during the course of an 
event or crisis that threatens public 
health (including natural or man-made 
disasters). 

(3) Collection and analysis of 
information, biospecimens, or records 
by or for a criminal justice agency for 
activities authorized by law or court 
order solely for criminal justice or 
criminal investigative purposes. 

(4) Authorized operational activities 
(as determined by each agency) in 
support of intelligence, homeland 
security, defense, or other national 
security missions. 

(m) Written, or in writing, for 
purposes of this part, refers to writing 
on a tangible medium (e.g., paper) or in 
an electronic format. 


§ .103 Assuring compliance with 
this policy—research conducted or 
supported by any Federal department 
or agency. 





(a) Each institution engaged in 
research that is covered by this policy, 
with the exception of research eligible 
forexemption under § _.104, and 
that is conducted or supported by a 
Federal department or agency, shall 
provide written assurance satisfactory to 
the department or agency head that it 
will comply with the requirements of 
this policy. In lieu of requiring 
submission of an assurance, individual 
department or agency heads shall accept 
the existence of a current assurance, 
appropriate for the research in question, 
on file with the Office for Human 
Research Protections, HHS, or any 


successor office, and approved for 
Federal-wide use by that office. When 
the existence of an HHS-approved 
assurance is accepted in lieu of 
requiring submission of an assurance, 
reports (except certification) required by 
this policy to be made to department 
and agency heads shall also be made to 
the Office for Human Research 
Protections, HHS, or any successor 
office. Federal departments and 
agencies will conduct or support 
research covered by this policy only if 
the institution has provided an 
assurance that it will comply with the 
requirements of this policy, as provided 
in this section, and only if the 
institution has certified to the 
department or agency head that the 
research has been reviewed and 
approved by an IRB (if such certification 
is required by § .103(d)). 

(b) The assurance shall be executed by 
an individual authorized to act for the 
institution and to assume on behalf of 
the institution the obligations imposed 
by this policy and shall be filed in such 
form and manner as the department or 
agency head prescribes. 

(c) The department or agency head 
may limit the period during which any 
assurance shall remain effective or 
otherwise condition or restrict the 
assurance. 

(d) Certification is required when the 
research is supported by a Federal 
department or agency and not otherwise 
waived under § .101(i) or exempted 
under § _.104. For such research, 
institutions shall certify that each 
proposed research study covered by the 
assurance and this section has been 
reviewed and approved by the IRB. 
Such certification must be submitted as 
prescribed by the Federal department or 
agency component supporting the 
research. Under no condition shall 
research covered by this section be 
initiated prior to receipt of the 
certification that the research has been 
reviewed and approved by the IRB. 

(e) For nonexempt research involving 
human subjects covered by this policy 
(or exempt research for which limited 
IRB review takes place pursuant to 
§__.104(d)(2) (iii), (d)(3)@)(C), or (d)(7) 
or (8)) that takes place at an institution 
in which IRB oversight is conducted by 
an IRB that is not operated by the 
institution, the institution and the 
organization operating the IRB shall 
document the institution’s reliance on 
the IRB for oversight of the research and 
the responsibilities that each entity will 
undertake to ensure compliance with 
the requirements of this policy (e.g., in 
a written agreement between the 
institution and the IRB, by 
implementation of an institution-wide 








policy directive providing the allocation 
of responsibilities between the 
institution and an IRB that is not 
affiliated with the institution, or as set 
forth in a research protocol). 


(Approved by the Office of Management and 
Budget under Control Number 0990-0260) 


§ .104 Exempt research. 


(a) Unless otherwise required by law 
or by department or agency heads, 
research activities in which the only 
involvement of human subjects will be 
in one or more of the categories in 
paragraph (d) of this section are exempt 
from the requirements of this policy, 
except that such activities must comply 
with the requirements of this section 
and as specified in each category. 

(b) Use of the exemption categories for 
research subject to the requirements of 
subparts B, C, and D: Application of the 
exemption categories to research subject 
to the requirements of 45 CFR part 46, 
subparts B, C, and D, is as follows: 

(1) Subpart B. Each of the exemptions 
at this section may be applied to 
research subject to subpart B if the 
conditions of the exemption are met. 

(2) Subpart C. The exemptions at this 
section do not apply to research subject 
to subpart C, except for research aimed 
at involving a broader subject 
population that only incidentally 
includes prisoners. 

(3) Subpart D. The exemptions at 
paragraphs (d)(1), (4), (5), (6), (7), and 
(8) of this section may be applied to 
research subject to subpart D if the 
conditions of the exemption are met. 
Paragraphs (d)(2)(i) and (ii) of this 
section only may apply to research 
subject to subpart D involving 
educational tests or the observation of 
public behavior when the investigator(s) 
do not participate in the activities being 
observed. Paragraph (d)(2)(iii) of this 
section may not be applied to research 
subject to subpart D. 

(c) [Reserved.] 

(d) Except as described in paragraph 
(a) of this section, the following 
categories of human subjects research 
are exempt from this policy: 

(1) Research, conducted in established 
or commonly accepted educational 
settings, that specifically involves 
normal educational practices that are 
not likely to adversely impact students’ 
opportunity to learn required 
educational content or the assessment of 
educators who provide instruction. This 
includes most research on regular and 
special education instructional 
strategies, and research on the 
effectiveness of or the comparison 
among instructional techniques, 
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curricula, or classroom management 
methods. 

(2) Research that only includes 
interactions involving educational tests 
(cognitive, diagnostic, aptitude, 
achievement), survey procedures, 
interview procedures, or observation of 
public behavior (including visual or 
auditory recording) if at least one of the 
following criteria is met: 

(i) The information obtained is 
recorded by the investigator in such a 
manner that the identity of the human 
subjects cannot readily be ascertained, 
directly or through identifiers linked to 
the subjects; 

(ii) Any disclosure of the human 
subjects’ responses outside the research 
would not reasonably place the subjects 
at risk of criminal or civil liability or be 
damaging to the subjects’ financial 
standing, employability, educational 
advancement, or reputation; or 

(iii) The information obtained is 
recorded by the investigator in such a 
manner that the identity of the human 
subjects can readily be ascertained, 
directly or through identifiers linked to 
the subjects, and an IRB conducts a 
limited IRB review to make the 
determination required by 
§ .111(a)(7). 

(3)(i) Research involving benign 
behavioral interventions in conjunction 
with the collection of information from 
an adult subject through verbal or 
written responses (including data entry) 
or audiovisual recording if the subject 
prospectively agrees to the intervention 
and information collection and at least 
one of the following criteria is met: 

(A) The information obtained is 
recorded by the investigator in such a 
manner that the identity of the human 
subjects cannot readily be ascertained, 
directly or through identifiers linked to 
the subjects; 

(B) Any disclosure of the human 
subjects’ responses outside the research 
would not reasonably place the subjects 
at risk of criminal or civil liability or be 
damaging to the subjects’ financial 
standing, employability, educational 
advancement, or reputation; or 

(C) The information obtained is 
recorded by the investigator in such a 
manner that the identity of the human 
subjects can readily be ascertained, 
directly or through identifiers linked to 
the subjects, and an IRB conducts a 
limited IRB review to make the 
determination required by 
§ .111(a)(7). 

(ii) For the purpose of this provision, 
benign behavioral interventions are brief 
in duration, harmless, painless, not 
physically invasive, not likely to have a 
significant adverse lasting impact on the 
subjects, and the investigator has no 








reason to think the subjects will find the 
interventions offensive or embarrassing. 
Provided all such criteria are met, 
examples of such benign behavioral 
interventions would include having the 
subjects play an online game, having 
them solve puzzles under various noise 
conditions, or having them decide how 
to allocate a nominal amount of 
received cash between themselves and 
someone else. 

(iii) If the research involves deceiving 
the subjects regarding the nature or 
purposes of the research, this exemption 
is not applicable unless the subject 
authorizes the deception through a 
prospective agreement to participate in 
research in circumstances in which the 
subject is informed that he or she will 
be unaware of or misled regarding the 
nature or purposes of the research. 

(4) Secondary research for which 
consent is not required: Secondary 
research uses of identifiable private 
information or identifiable 
biospecimens, if at least one of the 
following criteria is met: 

(i) The identifiable private 
information or identifiable 
biospecimens are publicly available; 

(ii) Information, which may include 
information about biospecimens, is 
recorded by the investigator in such a 
manner that the identity of the human 
subjects cannot readily be ascertained 
directly or through identifiers linked to 
the subjects, the investigator does not 
contact the subjects, and the investigator 
will not re-identify subjects; 

(iii) The research involves only 
information collection and analysis 
involving the investigator’s use of 
identifiable health information when 
that use is regulated under 45 CFR parts 
160 and 164, subparts A and E, for the 
purposes of “‘health care operations” or 
“research” as those terms are defined at 
45 CFR 164.501 or for “public health 
activities and purposes” as described 
under 45 CFR 164.512(b); or 

(iv) The research is conducted by, or 
on behalf of, a Federal department or 
agency using government-generated or 
government-collected information 
obtained for nonresearch activities, if 
the research generates identifiable 
private information that is or will be 
maintained on information technology 
that is subject to and in compliance 
with section 208(b) of the E-Government 
Act of 2002, 44 U.S.C. 3501 note, if all 
of the identifiable private information 
collected, used, or generated as part of 
the activity will be maintained in 
systems of records subject to the Privacy 
Act of 1974, 5 U.S.C. 552a, and, if 
applicable, the information used in the 
research was collected subject to the 


Paperwork Reduction Act of 1995, 44 
U.S.C. 3501 et seq. 

(5) Research and demonstration 
projects that are conducted or supported 
by a Federal department or agency, or 
otherwise subject to the approval of 
department or agency heads (or the 
approval of the heads of bureaus or 
other subordinate agencies that have 
been delegated authority to conduct the 
research and demonstration projects), 
and that are designed to study, evaluate, 
improve, or otherwise examine public 
benefit or service programs, including 
procedures for obtaining benefits or 
services under those programs, possible 
changes in or alternatives to those 
programs or procedures, or possible 
changes in methods or levels of 
payment for benefits or services under 
those programs. Such projects include, 
but are not limited to, internal studies 
by Federal employees, and studies 
under contracts or consulting 
arrangements, cooperative agreements, 
or grants. Exempt projects also include 
waivers of otherwise mandatory 
requirements using authorities such as 
sections 1115 and 1115A of the Social 
Security Act, as amended. 

(i) Each Federal department or agency 
conducting or supporting the research 
and demonstration projects must 
establish, on a publicly accessible 
Federal Web site or in such other 
manner as the department or agency 
head may determine, a list of the 
research and demonstration projects 
that the Federal department or agency 
conducts or supports under this 
provision. The research or 
demonstration project must be 
published on this list prior to 
commencing the research involving 
human subjects. 

(ii) [Reserved] 

(6) Taste and food quality evaluation 
and consumer acceptance studies: 

(i) If wholesome foods without 
additives are consumed, or 

(ii) If a food is consumed that contains 
a food ingredient at or below the level 
and for a use found to be safe, or 
agricultural chemical or environmental 
contaminant at or below the level found 
to be safe, by the Food and Drug 
Administration or approved by the 
Environmental Protection Agency or the 
Food Safety and Inspection Service of 
the U.S. Department of Agriculture. 

(7) Storage or maintenance for 
secondary research for which broad 
consent is required: Storage or 
maintenance of identifiable private 
information or identifiable 
biospecimens for potential secondary 
research use if an IRB conducts a 
limited IRB review and makes the 
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determinations required by 
§ _.111(a)(8). 

(8) Secondary research for which 
broad consent is required: Research 
involving the use of identifiable private 
information or identifiable 
biospecimens for secondary research 
use, if the following criteria are met: 

(i) Broad consent for the storage, 
maintenance, and secondary research 
use of the identifiable private 
information or identifiable 
biospecimens was obtained in 
accordance with § _.116(a)(1) 
through (4), (a)(6), and (d); 

(ii) Documentation of informed 
consent or waiver of documentation of 
consent was obtained in accordance 
with § _—.117; 

(iii) An IRB conducts a limited IRB 
review and makes the determination 
required by § _.111(a)(7) and makes 
the determination that the research to be 
conducted is within the scope of the 
broad consent referenced in paragraph 
(d)(8)(i) of this section; and (iv) The 
investigator does not include returning 
individual research results to subjects as 
part of the study plan. This provision 
does not prevent an investigator from 
abiding by any legal requirements to 
return individual research results. 


(Approved by the Office of Management and 
Budget under Control Number 0990-0260) 


§ 105 
§ 106 
§ .107 IRB membership. 


(a) Each IRB shall have at least five 
members, with varying backgrounds to 
promote complete and adequate review 
of research activities commonly 
conducted by the institution. The IRB 
shall be sufficiently qualified through 
the experience and expertise of its 
members (professional competence), 
and the diversity of its members, 
including race, gender, and cultural 
backgrounds and sensitivity to such 
issues as community attitudes, to 
promote respect for its advice and 
counsel in safeguarding the rights and 
welfare of human subjects. The IRB 
shall be able to ascertain the 
acceptability of proposed research in 
terms of institutional commitments 
(including policies and resources) and 
regulations, applicable law, and 
standards of professional conduct and 
practice. The IRB shall therefore include 
persons knowledgeable in these areas. If 
an IRB regularly reviews research that 
involves a category of subjects that is 
vulnerable to coercion or undue 
influence, such as children, prisoners, 
individuals with impaired decision- 
making capacity, or economically or 


[Reserved.] 


[Reserved] 


educationally disadvantaged persons, 
consideration shall be given to the 
inclusion of one or more individuals 
who are knowledgeable about and 
experienced in working with these 
categories of subjects. 

(b) Each IRB shall include at least one 
member whose primary concerns are in 
scientific areas and at least one member 
whose primary concerns are in 
nonscientific areas. 

(c) Each IRB shall include at least one 
member who is not otherwise affiliated 
with the institution and who is not part 
of the immediate family of a person who 
is affiliated with the institution. 

(d) No IRB may have a member 
participate in the IRB’s initial or 
continuing review of any project in 
which the member has a conflicting 
interest, except to provide information 
requested by the IRB. 

(e) An IRB may, in its discretion, 
invite individuals with competence in 
special areas to assist in the review of 
issues that require expertise beyond or 
in addition to that available on the IRB. 
These individuals may not vote with the 
IRB. 


§ .108 IRB functions and 
operations. 


(a) In order to fulfill the requirements 
of this policy each IRB shall: 

(1) Have access to meeting space and 
sufficient staff to support the IRB’s 
review and recordkeeping duties; 

(2) Prepare and maintain a current list 
of the IRB members identified by name; 
earned degrees; representative capacity; 
indications of experience such as board 
certifications or licenses sufficient to 
describe each member’s chief 
anticipated contributions to IRB 
deliberations; and any employment or 
other relationship between each 
member and the institution, for 
example, full-time employee, part-time 
employee, member of governing panel 
or board, stockholder, paid or unpaid 
consultant; 

(3) Establish and follow written 
procedures for: 

(i) Conducting its initial and 
continuing review of research and for 
reporting its findings and actions to the 
investigator and the institution; 

(ii) Determining which projects 
require review more often than annually 
and which projects need verification 
from sources other than the 
investigators that no material changes 
have occurred since previous IRB 
review; and 

(iii) Ensuring prompt reporting to the 
IRB of proposed changes in a research 
activity, and for ensuring that 
investigators will conduct the research 
activity in accordance with the terms of 


the IRB approval until any proposed 
changes have been reviewed and 
approved by the IRB, except when 
necessary to eliminate apparent 
immediate hazards to the subject. 

(4) Establish and follow written 
procedures for ensuring prompt 
reporting to the IRB; appropriate 
institutional officials; the department or 
agency head; and the Office for Human 
Research Protections, HHS, or any 
successor office, or the equivalent office 
within the appropriate Federal 
department or agency of 

(i) Any unanticipated problems 
involving risks to subjects or others or 
any serious or continuing 
noncompliance with this policy or the 
requirements or determinations of the 
IRB; and 

(ii) Any suspension or termination of 
IRB approval. 

(b) Except when an expedited review 
procedure is used (as described in 
§ .110), an IRB must review 
proposed research at convened meetings 
at which a majority of the members of 
the IRB are present, including at least 
one member whose primary concerns 
are in nonscientific areas. In order for 
the research to be approved, it shall 
receive the approval of a majority of 
those members present at the meeting. 





(Approved by the Office of Management and 
Budget under Control Number 0990-0260) 


§ .109 IRB review of research. 


(a) An IRB shall review and have 
authority to approve, require 
modifications in (to secure approval), or 
disapprove all research activities 
covered by this policy, including 
exempt research activities under 
§ __.104 for which limited IRB review 
is a condition of exemption (under 
§ .104(d)(2)(iii), (d)(3)(@)(C), and 
(d)(7), and (8)). 

(b) An IRB shall require that 
information given to subjects (or legally 
authorized representatives, when 
appropriate) as part of informed consent 
is in accordance with § __.116. The 
IRB may require that information, in 
addition to that specifically mentioned 
in § .116, be given to the subjects 
when in the IRB’s judgment the 
information would meaningfully add to 
the protection of the rights and welfare 
of subjects. 

(c) An IRB shall require 
documentation of informed consent or 
may waive documentation in 
accordance with § 117. 

(d) An IRB shall notify investigators 
and the institution in writing of its 
decision to approve or disapprove the 
proposed research activity, or of 
modifications required to secure IRB 
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approval of the research activity. If the 
IRB decides to disapprove a research 
activity, it shall include in its written 
notification a statement of the reasons 
for its decision and give the investigator 
an opportunity to respond in person or 
in writing. 

(e) An IRB shall conduct continuing 
review of research requiring review by 
the convened IRB at intervals 
appropriate to the degree of risk, not 
less than once per year, except as 
described in § _.109(f). 

(f)(1) Unless an IRB determines 
otherwise, continuing review of 
research is not required in the following 
circumstances: 

(i) Research eligible for expedited 
review in accordance with § .110; 

(ii) Research reviewed by the IRB in 
accordance with the limited IRB review 
described in § _.104(d)(2) (iii), 
(d)(3)(@)(C), or (d)(7) or (8); 

(iii) Research that has progressed to 
the point that it involves only one or 
both of the following, which are part of 
the IRB-approved study: 

(A) Data analysis, including analysis 
of identifiable private information or 
identifiable biospecimens, or 

(B) Accessing follow-up clinical data 
from procedures that subjects would 
undergo as part of clinical care. 

(2) [Reserved.] 

(g) An IRB shall have authority to 
observe or have a third party observe the 
consent process and the research. 





(Approved by the Office of Management and 
Budget under Control Number 0990-0260) 


§ _.110 Expedited review 
procedures for certain kinds of 
research involving no more than 
minimal risk, and for minor changes in 
approved research. 


(a) The Secretary of HHS has 
established, and published as a Notice 
in the Federal Register, a list of 
categories of research that may be 
reviewed by the IRB through an 
expedited review procedure. The 
Secretary will evaluate the list at least 
every 8 years and amend it, as 
appropriate, after consultation with 
other federal departments and agencies 
and after publication in the Federal 
Register for public comment. A copy of 
the list is available from the Office for 
Human Research Protections, HHS, or 
any successor office. 

(b)(1) An IRB may use the expedited 
review procedure to review the 
following: 

(i) Some or all of the research 
appearing on the list described in 
paragraph (a) of this section, unless the 
reviewer determines that the study 
involves more than minimal risk; 


(ii) Minor changes in previously 
approved research during the period for 
which approval is authorized; or 

(iii) Research for which limited IRB 
review is a condition of exemption 
under § _.104(d)(2)(iii), (d)(3)(i)(C), 
and (d)(7) and (8). 

(2) Under an expedited review 
procedure, the review may be carried 
out by the IRB chairperson or by one or 
more experienced reviewers designated 
by the chairperson from among 
members of the IRB. In reviewing the 
research, the reviewers may exercise all 
of the authorities of the IRB except that 
the reviewers may not disapprove the 
research. A research activity may be 
disapproved only after review in 
accordance with the nonexpedited 
procedure set forth in § .108(b). 

(c) Each IRB that uses an expedited 
review procedure shall adopt a method 
for keeping all members advised of 
research proposals that have been 
approved under the procedure. 

(d) The department or agency head 
may restrict, suspend, terminate, or 
choose not to authorize an institution’s 
or IRB’s use of the expedited review 
procedure. 





§ 111 Criteria for IRB approval of 
research. 


(a) In order to approve research 
covered by this policy the IRB shall 
determine that all of the following 
requirements are satisfied: 

(1) Risks to subjects are minimized: 

(i) By using procedures that are 
consistent with sound research design 
and that do not unnecessarily expose 
subjects to risk, and 

(ii) Whenever appropriate, by using 
procedures already being performed on 
the subjects for diagnostic or treatment 
purposes. 

(2) Risks to subjects are reasonable in 
relation to anticipated benefits, if any, to 
subjects, and the importance of the 
knowledge that may reasonably be 
expected to result. In evaluating risks 
and benefits, the IRB should consider 
only those risks and benefits that may 
result from the research (as 
distinguished from risks and benefits of 
therapies subjects would receive even if 
not participating in the research). The 
IRB should not consider possible long- 
range effects of applying knowledge 
gained in the research (e.g., the possible 
effects of the research on public policy) 
as among those research risks that fall 
within the purview of its responsibility. 

(3) Selection of subjects is equitable. 
In making this assessment the IRB 
should take into account the purposes of 
the research and the setting in which 
the research will be conducted. The IRB 
should be particularly cognizant of the 


special problems of research that 
involves a category of subjects who are 
vulnerable to coercion or undue 
influence, such as children, prisoners, 
individuals with impaired decision- 
making capacity, or economically or 
educationally disadvantaged persons. 

(4) Informed consent will be sought 
from each prospective subject or the 
subject’s legally authorized 
representative, in accordance with, and 
to the extent required by,§ _—_—.116. 

(5) Informed consent will be 
appropriately documented or 
appropriately waived in accordance 
with § 117. 

(6) When appropriate, the research 
plan makes adequate provision for 
monitoring the data collected to ensure 
the safety of subjects. 

(7) When appropriate, there are 
adequate provisions to protect the 
privacy of subjects and to maintain the 
confidentiality of data. 

(i) The Secretary of HHS will, after 
consultation with the Office of 
Management and Budget’s privacy office 
and other Federal departments and 
agencies that have adopted this policy, 
issue guidance to assist IRBs in 
assessing what provisions are adequate 
to protect the privacy of subjects and to 
maintain the confidentiality of data. 

(ii) [Reserved.] 

(8) For purposes of conducting the 
limited IRB review required by 
§ .104(d)(7)), the IRB need not make 
the determinations at paragraphs (a)(1) 
through (7) of this section, and shall 
make the following determinations: 

(i) Broad consent for storage, 
maintenance, and secondary research 
use of identifiable private information 
or identifiable biospecimens is obtained 
in accordance with the requirements of 
§___.116(a)(1)-(4), (a)(6), and (d); 

(ii) Broad consent is appropriately 
documented or waiver of 
documentation is appropriate, in 
accordance with § __—.117; and 

(iii) If there is a change made for 
research purposes in the way the 
identifiable private information or 
identifiable biospecimens are stored or 
maintained, there are adequate 
provisions to protect the privacy of 
subjects and to maintain the 
confidentiality of data. 

(b) When some or all of the subjects 
are likely to be vulnerable to coercion or 
undue influence, such as children, 
prisoners, individuals with impaired 
decision-making capacity, or 
economically or educationally 
disadvantaged persons, additional 
safeguards have been included in the 
study to protect the rights and welfare 
of these subjects. 
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§ 112 Review by Institution 


Research covered by this policy that 
has been approved by an IRB may be 
subject to further appropriate review 
and approval or disapproval by officials 
of the institution. However, those 
officials may not approve the research if 
it has not been approved by an IRB. 


§ .113 Suspension or Termination 
of IRB Approval of Research 


An IRB shall have authority to 
suspend or terminate approval of 
research that is not being conducted in 
accordance with the IRB’s requirements 
or that has been associated with 
unexpected serious harm to subjects. 
Any suspension or termination of 
approval shall include a statement of 
the reasons for the IRB’s action and 
shall be reported promptly to the 
investigator, appropriate institutional 
officials, and the department or agency 
head. 


(Approved by the Office of Management and 
Budget under Control Number 0990-0260) 


§ .114 Cooperative Research 


(a) Cooperative research projects are 
those projects covered by this policy 
that involve more than one institution. 
In the conduct of cooperative research 
projects, each institution is responsible 
for safeguarding the rights and welfare 
of human subjects and for complying 
with this policy. 

(b)(1) Any institution located in the 
United States that is engaged in 
cooperative research must rely upon 
approval by a single IRB for that portion 
of the research that is conducted in the 
United States. The reviewing IRB will 
be identified by the Federal department 
or agency supporting or conducting the 
research or proposed by the lead 
institution subject to the acceptance of 
the Federal department or agency 
supporting the research. 

(2) The following research is not 
subject to this provision: 

(i) Cooperative research for which 
more than single IRB review is required 
by law (including tribal law passed by 
the official governing body of an 
American Indian or Alaska Native tribe); 
or 

(ii) Research for which any Federal 
department or agency supporting or 
conducting the research determines and 
documents that the use of a single IRB 
is not appropriate for the particular 
context. 

(c) For research not subject to 
paragraph (b) of this section, an 
institution participating in a cooperative 
project may enter into a joint review 
arrangement, rely on the review of 
another IRB, or make similar 


arrangements for avoiding duplication 
of effort. 


§ .115 IRB Records 


(a) An institution, or when 
appropriate an IRB, shall prepare and 
maintain adequate documentation of 
IRB activities, including the following: 

(1) Copies of all research proposals 
reviewed, scientific evaluations, if any, 
that accompany the proposals, approved 
sample consent forms, progress reports 
submitted by investigators, and reports 
of injuries to subjects. 

(2) Minutes of IRB meetings, which 
shall be in sufficient detail to show 
attendance at the meetings; actions 
taken by the IRB; the vote on these 
actions including the number of 
members voting for, against, and 
abstaining; the basis for requiring 
changes in or disapproving research; 
and a written summary of the 
discussion of controverted issues and 
their resolution. 

(3) Records of continuing review 
activities, including the rationale for 
conducting continuing review of 
research that otherwise would not 
require continuing review as described 
in § .109(f)(1). 

(4) Copies of all correspondence 
between the IRB and the investigators. 

(5) A list of IRB members in the same 
detail as described in § _.108(a)(2). 

(6) Written procedures for the IRB in 
the same detail as described in 
§ _.108(a)(3) and (4). 

(7) Statements of significant new 
findings provided to subjects, as 
required by § _.116(c)(5). 

(8) The rationale for an expedited 
reviewer’s determination under 
§ _.110(b)(1)(i) that research 
appearing on the expedited review list 
described in § _.110(a) is more than 
minimal risk. 

(9) Documentation specifying the 
responsibilities that an institution and 
an organization operating an IRB each 
will undertake to ensure compliance 
with the requirements of this policy, as 
describedin§ _.103(e). 

(b) The records required by this policy 
shall be retained for at least 3 years, and 
records relating to research that is 
conducted shall be retained for at least 
3 years after completion of the research. 
The institution or IRB may maintain the 
records in printed form, or 
electronically. All records shall be 
accessible for inspection and copying by 
authorized representatives of the 
Federal department or agency at 
reasonable times and in a reasonable 
manner. 





(Approved by the Office of Management and 
Budget under Control Number 0990-0260) 


§ .116 General Requirements for 
Informed Consent 





(a) General. General requirements for 
informed consent, whether written or 
oral, are set forth in this paragraph and 
apply to consent obtained in accordance 
with the requirements set forth in 
paragraphs (b) through (d) of this 
section. Broad consent may be obtained 
in lieu of informed consent obtained in 
accordance with paragraphs (b) and (c) 
of this section only with respect to the 
storage, maintenance, and secondary 
research uses of identifiable private 
information and identifiable 
biospecimens. Waiver or alteration of 
consent in research involving public 
benefit and service programs conducted 
by or subject to the approval of state or 
local officials is described in paragraph 
(e) of this section. General waiver or 
alteration of informed consent is 
described in paragraph (f) of this 
section. Except as provided elsewhere 
in this policy: 

(1) Before involving a human subject 
in research covered by this policy, an 
investigator shall obtain the legally 
effective informed consent of the subject 
or the subject’s legally authorized 
representative. 

(2) An investigator shall seek 
informed consent only under 
circumstances that provide the 
prospective subject or the legally 
authorized representative sufficient 
opportunity to discuss and consider 
whether or not to participate and that 
minimize the possibility of coercion or 
undue influence. 

(3) The information that is given to 
the subject or the legally authorized 
representative shall be in language 
understandable to the subject or the 
legally authorized representative. 

(4) The prospective subject or the 
legally authorized representative must 
be provided with the information that a 
reasonable person would want to have 
in order to make an informed decision 
about whether to participate, and an 
opportunity to discuss that information. 

(5) Except for broad consent obtained 
in accordance with paragraph (d) of this 
section: 

(i) Informed consent must begin with 
a concise and focused presentation of 
the key information that is most likely 
to assist a prospective subject or legally 
authorized representative in 
understanding the reasons why one 
might or might not want to participate 
in the research. This part of the 
informed consent must be organized 
and presented in a way that facilitates 
comprehension. 

(ii) Informed consent as a whole must 
present information in sufficient detail 
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relating to the research, and must be 
organized and presented in a way that 
does not merely provide lists of isolated 
facts, but rather facilitates the 
prospective subject’s or legally 
authorized representative’s 
understanding of the reasons why one 
might or might not want to participate. 

(6) No informed consent may include 
any exculpatory language through 
which the subject or the legally 
authorized representative is made to 
waive or appear to waive any of the 
subject’s legal rights, or releases or 
appears to release the investigator, the 
sponsor, the institution, or its agents 
from liability for negligence. 

(b) Basic elements of informed 
consent. Except as provided in 
paragraph (d), (e), or (f) of this section, 
in seeking informed consent the 
following information shall be provided 
to each subject or the legally authorized 
representative: 

(1) A statement that the study 
involves research, an explanation of the 
purposes of the research and the 
expected duration of the subject’s 
participation, a description of the 
procedures to be followed, and 
identification of any procedures that are 
experimental; 

(2) A description of any reasonably 
foreseeable risks or discomforts to the 
subject; 

(3) A description of any benefits to the 
subject or to others that may reasonably 
be expected from the research; 

(4) A disclosure of appropriate 
alternative procedures or courses of 
treatment, if any, that might be 
advantageous to the subject; 

(5) A statement describing the extent, 
if any, to which confidentiality of 
records identifying the subject will be 
maintained; 

(6) For research involving more than 
minimal risk, an explanation as to 
whether any compensation and an 
explanation as to whether any medical 
treatments are available if injury occurs 
and, if so, what they consist of, or where 
further information may be obtained; 

(7) An explanation of whom to 
contact for answers to pertinent 
questions about the research and 
research subjects’ rights, and whom to 
contact in the event of a research-related 
injury to the subject; 

(8) A statement that participation is 
voluntary, refusal to participate will 
involve no penalty or loss of benefits to 
which the subject is otherwise entitled, 
and the subject may discontinue 
participation at any time without 
penalty or loss of benefits to which the 
subject is otherwise entitled; and 

(9) One of the following statements 
about any research that involves the 


collection of identifiable private 
information or identifiable 
biospecimens: 

(i) A statement that identifiers might 
be removed from the identifiable private 
information or identifiable 
biospecimens and that, after such 
removal, the information or 
biospecimens could be used for future 
research studies or distributed to 
another investigator for future research 
studies without additional informed 
consent from the subject or the legally 
authorized representative, if this might 
be a possibility; or 

(ii) A statement that the subject’s 
information or biospecimens collected 
as part of the research, even if 
identifiers are removed, will not be used 
or distributed for future research 
studies. 

(c) Additional elements of informed 
consent. Except as provided in 
paragraph (qd), (e), or (f) of this section, 
one or more of the following elements 
of information, when appropriate, shall 
also be provided to each subject or the 
legally authorized representative: 

(1) A statement that the particular 
treatment or procedure may involve 
risks to the subject (or to the embryo or 
fetus, if the subject is or may become 
pregnant) that are currently 
unforeseeable; 

(2) Anticipated circumstances under 
which the subject’s participation may be 
terminated by the investigator without 
regard to the subject’s or the legally 
authorized representative’s consent; 

(3) Any additional costs to the subject 
that may result from participation in the 
research; 

(4) The consequences of a subject’s 
decision to withdraw from the research 
and procedures for orderly termination 
of participation by the subject; 

(5) A statement that significant new 
findings developed during the course of 
the research that may relate to the 
subject’s willingness to continue 
participation will be provided to the 
subject; 

(6) The approximate number of 
subjects involved in the study; 

(7) A statement that the subject’s 
biospecimens (even if identifiers are 
removed) may be used for commercial 
profit and whether the subject will or 
will not share in this commercial profit; 

(8) A statement regarding whether 
clinically relevant research results, 
including individual research results, 
will be disclosed to subjects, and if so, 
under what conditions; and 

(9) For research involving 
biospecimens, whether the research will 
(if known) or might include whole 
genome sequencing (i.e., sequencing of 
a human germline or somatic specimen 


with the intent to generate the genome 
or exome sequence of that specimen). 

(d) Elements of broad consent for the 
storage, maintenance, and secondary 
research use of identifiable private 
information or identifiable 
biospecimens. Broad consent for the 
storage, maintenance, and secondary 
research use of identifiable private 
information or identifiable 
biospecimens (collected for either 
research studies other than the proposed 
research or nonresearch purposes) is 
permitted as an alternative to the 
informed consent requirements in 
paragraphs (b) and (c) of this section. If 
the subject or the legally authorized 
representative is asked to provide broad 
consent, the following shall be provided 
to each subject or the subject’s legally 
authorized representative: 

(1) The information required in 
paragraphs (b)(2), (b)(3), (b)(5), and 
(b)(8) and, when appropriate, (c)(7) and 
(9) of this section; 

(2) A general description of the types 
of research that may be conducted with 
the identifiable private information or 
identifiable biospecimens. This 
description must include sufficient 
information such that a reasonable 
person would expect that the broad 
consent would permit the types of 
research conducted; 

(3) A description of the identifiable 
private information or identifiable 
biospecimens that might be used in 
research, whether sharing of identifiable 
private information or identifiable 
biospecimens might occur, and the 
types of institutions or researchers that 
might conduct research with the 
identifiable private information or 
identifiable biospecimens; 

(4) A description of the period of time 
that the identifiable private information 
or identifiable biospecimens may be 
stored and maintained (which period of 
time could be indefinite), and a 
description of the period of time that the 
identifiable private information or 
identifiable biospecimens may be used 
for research purposes (which period of 
time could be indefinite); 

(5) Unless the subject or legally 
authorized representative will be 
provided details about specific research 
studies, a statement that they will not be 
informed of the details of any specific 
research studies that might be 
conducted using the subject’s 
identifiable private information or 
identifiable biospecimens, including the 
purposes of the research, and that they 
might have chosen not to consent to 
some of those specific research studies; 

(6) Unless it is known that clinically 
relevant research results, including 
individual research results, will be 
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disclosed to the subject in all 
circumstances, a statement that such 
results may not be disclosed to the 
subject; and 

(7) An explanation of whom to 
contact for answers to questions about 
the subject’s rights and about storage 
and use of the subject’s identifiable 
private information or identifiable 
biospecimens, and whom to contact in 
the event of a research-related harm. 

(e) Waiver or alteration of consent in 
research involving public benefit and 
service programs conducted by or 
subject to the approval of state or local 
officials—(1) Waiver. An IRB may waive 
the requirement to obtain informed 
consent for research under paragraphs 
(a) through (c) of this section, provided 
the IRB satisfies the requirements of 
paragraph (e)(3) of this section. If an 
individual was asked to provide broad 
consent for the storage, maintenance, 
and secondary research use of 
identifiable private information or 
identifiable biospecimens in accordance 
with the requirements at paragraph (d) 
of this section, and refused to consent, 
an IRB cannot waive consent for the 
storage, maintenance, or secondary 
research use of the identifiable private 
information or identifiable 
biospecimens. 

(2) Alteration. An IRB may approve a 
consent procedure that omits some, or 
alters some or all, of the elements of 
informed consent set forth in paragraphs 
(b) and (c) of this section provided the 
IRB satisfies the requirements of 
paragraph (e)(3) of this section. An IRB 
may not omit or alter any of the 
requirements described in paragraph (a) 
of this section. If a broad consent 
procedure is used, an IRB may not omit 
or alter any of the elements required 
under paragraph (d) of this section. 

(3) Requirements for waiver and 
alteration. In order for an IRB to waive 
or alter consent as described in this 
subsection, the IRB must find and 
document that: 

(i) The research or demonstration 
project is to be conducted by or subject 
to the approval of state or local 
government officials and is designed to 
study, evaluate, or otherwise examine: 

(A) Public benefit or service programs; 

(B) Procedures for obtaining benefits 
or services under those programs; 

(C) Possible changes in or alternatives 
to those programs or procedures; or 

(D) Possible changes in methods or 
levels of payment for benefits or 
services under those programs; and 

(ii) The research could not practicably 
be carried out without the waiver or 
alteration. 

(f) General waiver or alteration of 
consent—(1) Waiver. An IRB may waive 


the requirement to obtain informed 
consent for research under paragraphs 
(a) through (c) of this section, provided 
the IRB satisfies the requirements of 
paragraph (f)(3) of this section. If an 
individual was asked to provide broad 
consent for the storage, maintenance, 
and secondary research use of 
identifiable private information or 
identifiable biospecimens in accordance 
with the requirements at paragraph (d) 
of this section, and refused to consent, 
an IRB cannot waive consent for the 
storage, maintenance, or secondary 
research use of the identifiable private 
information or identifiable 
biospecimens. 

(2) Alteration. An IRB may approve a 
consent procedure that omits some, or 
alters some or all, of the elements of 
informed consent set forth in paragraphs 
(b) and (c) of this section provided the 
IRB satisfies the requirements of 
paragraph (f)(3) of this section. An IRB 
may not omit or alter any of the 
requirements described in paragraph (a) 
of this section. If a broad consent 
procedure is used, an IRB may not omit 
or alter any of the elements required 
under paragraph (d) of this section. 

(3) Requirements for waiver and 
alteration. In order for an IRB to waive 
or alter consent as described in this 
subsection, the IRB must find and 
document that: 

(i) The research involves no more 
than minimal risk to the subjects; 

(ii) The research could not practicably 
be carried out without the requested 
waiver or alteration; 

(iii) If the research involves using 
identifiable private information or 
identifiable biospecimens, the research 
could not practicably be carried out 
without using such information or 
biospecimens in an identifiable format; 

(iv) The waiver or alteration will not 
adversely affect the rights and welfare of 
the subjects; and 

(v) Whenever appropriate, the 
subjects or legally authorized 
representatives will be provided with 
additional pertinent information after 
participation. 

(g) Screening, recruiting, or 
determining eligibility. An IRB may 
approve a research proposal in which an 
investigator will obtain information or 
biospecimens for the purpose of 
screening, recruiting, or determining the 
eligibility of prospective subjects 
without the informed consent of the 
prospective subject or the subject’s 
legally authorized representative, if 
either of the following conditions are 
met: 

(1) The investigator will obtain 
information through oral or written 
communication with the prospective 


subject or legally authorized 
representative, or 


(2) The investigator will obtain 
identifiable private information or 
identifiable biospecimens by accessing 
records or stored identifiable 
biospecimens. 


(h) Posting of clinical trial consent 
form. (1) For each clinical trial 
conducted or supported by a Federal 
department or agency, one IRB- 
approved informed consent form used 
to enroll subjects must be posted by the 
awardee or the Federal department or 
agency component conducting the trial 
on a publicly available Federal Web site 
that will be established as a repository 
for such informed consent forms. 


(2) If the Federal department or 
agency supporting or conducting the 
clinical trial determines that certain 
information should not be made 
publicly available on a Federal Web site 
(e.g. confidential commercial 
information), such Federal department 
or agency may permit or require 
redactions to the information posted. 


(3) The informed consent form must 
be posted on the Federal Web site after 
the clinical trial is closed to 
recruitment, and no later than 60 days 
after the last study visit by any subject, 
as required by the protocol. 


(i) Preemption. The informed consent 
requirements in this policy are not 
intended to preempt any applicable 
Federal, state, or local laws (including 
tribal laws passed by the official 
governing body of an American Indian 
or Alaska Native tribe) that require 
additional information to be disclosed 
in order for informed consent to be 
legally effective. 

(j) Emergency medical care. Nothing 
in this policy is intended to limit the 
authority of a physician to provide 
emergency medical care, to the extent 
the physician is permitted to do so 
under applicable Federal, state, or local 
law (including tribal law passed by the 
official governing body of an American 
Indian or Alaska Native tribe). 


(Approved by the Office of Management and 
Budget under Control Number 0990-0260) 


§ 117. Documentation of informed 
consent. 





(a) Except as provided in paragraph 
(c) of this section, informed consent 
shall be documented by the use of a 
written informed consent form 
approved by the IRB and signed 
(including in an electronic format) by 
the subject or the subject’s legally 
authorized representative. A written 
copy shall be given to the person 
signing the informed consent form. 
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(b) Except as provided in paragraph 
(c) of this section, the informed consent 
form may be either of the following: 

(1) A written informed consent form 
that meets the requirements of 
§ _.116. The investigator shall give 
either the subject or the subject’s legally 
authorized representative adequate 
opportunity to read the informed 
consent form before it is signed; 
alternatively, this form may be read to 
the subject or the subject’s legally 
authorized representative. 

(2) A short form written informed 
consent form stating that the elements of 
informed consent required by § _—.116 
have been presented orally to the 
subject or the subject’s legally 
authorized representative, and that the 
key information required by 
§ _.116(a)(5)(i) was presented first to 
the subject, before other information, if 
any, was provided. The IRB shall 
approve a written summary of what is 
to be said to the subject or the legally 
authorized representative. When this 
method is used, there shall be a witness 
to the oral presentation. Only the short 
form itself is to be signed by the subject 
or the subject’s legally authorized 
representative. However, the witness 
shall sign both the short form and a 
copy of the summary, and the person 
actually obtaining consent shall sign a 
copy of the summary. A copy of the 
summary shall be given to the subject or 
the subject’s legally authorized 
representative, in addition to a copy of 
the short form. 

(c)(1) An IRB may waive the 
requirement for the investigator to 
obtain a signed informed consent form 
for some or all subjects if it finds any 
of the following: 

(i) That the only record linking the 
subject and the research would be the 
informed consent form and the 
principal risk would be potential harm 
resulting from a breach of 
confidentiality. Each subject (or legally 
authorized representative) will be asked 
whether the subject wants 
documentation linking the subject with 
the research, and the subject’s wishes 
will govern; 

(ii) That the research presents no 
more than minimal risk of harm to 
subjects and involves no procedures for 
which written consent is normally 
required outside of the research context; 
or 

(iii) If the subjects or legally 
authorized representatives are members 
of a distinct cultural group or 
community in which signing forms is 
not the norm, that the research presents 
no more than minimal risk of harm to 
subjects and provided there is an 
appropriate alternative mechanism for 


documenting that informed consent was 
obtained. 

(2) In cases in which the 
documentation requirement is waived, 
the IRB may require the investigator to 
provide subjects or legally authorized 
representatives with a written statement 
regarding the research. 


(Approved by the Office of Management and 
Budget under Control Number 0990-0260) 


§ .118 Applications and proposals 
lacking definite plans for involvement 
of human subjects. 


Certain types of applications for 
grants, cooperative agreements, or 
contracts are submitted to Federal 
departments or agencies with the 
knowledge that subjects may be 
involved within the period of support, 
but definite plans would not normally 
be set forth in the application or 
proposal. These include activities such 
as institutional type grants when 
selection of specific projects is the 
institution’s responsibility; research 
training grants in which the activities 
involving subjects remain to be selected; 
and projects in which human subjects’ 
involvement will depend upon 
completion of instruments, prior animal 
studies, or purification of compounds. 
Except for research waived under 
§ _.101(i) or exempted under 
§ _.104, no human subjects may be 
involved in any project supported by 
these awards until the project has been 
reviewed and approved by the IRB, as 
provided in this policy, and certification 
submitted, by the institution, to the 
Federal department or agency 
component supporting the research. 


§ .119 Research undertaken 


without the intention of involving 
human subjects. 


Except for research waived under 
§ _.101(i) or exempted under 
§ _.104, in the event research is 
undertaken without the intention of 
involving human subjects, but it is later 
proposed to involve human subjects in 
the research, the research shall first be 
reviewed and approved by an IRB, as 
provided in this policy, a certification 
submitted by the institution to the 
Federal department or agency 
component supporting the research, and 
final approval given to the proposed 
change by the Federal department or 
agency component. 


§ _.120 Evaluation and disposition 
of applications and proposals for 
research to be conducted or supported 
by a Federal department or agency. 


(a) The department or agency head 
will evaluate all applications and 
proposals involving human subjects 


submitted to the Federal department or 
agency through such officers and 
employees of the Federal department or 
agency and such experts and 
consultants as the department or agency 
head determines to be appropriate. This 
evaluation will take into consideration 
the risks to the subjects, the adequacy of 
protection against these risks, the 
potential benefits of the research to the 
subjects and others, and the importance 
of the knowledge gained or to be gained. 

(b) On the basis of this evaluation, the 
department or agency head may approve 
or disapprove the application or 
proposal, or enter into negotiations to 
develop an approvable one. 


§ .121 [Reserved] 
§ 122 Use of Federal funds. 


Federal funds administered by a 
Federal department or agency may not 
be expended for research involving 
human subjects unless the requirements 
of this policy have been satisfied. 


§ 123 Early termination of 
research support: Evaluation of 
applications and proposals. 





(a) The department or agency head 
may require that Federal department or 
agency support for any project be 
terminated or suspended in the manner 
prescribed in applicable program 
requirements, when the department or 
agency head finds an institution has 
materially failed to comply with the 
terms of this policy. 

(b) In making decisions about 
supporting or approving applications or 
proposals covered by this policy the 
department or agency head may take 
into account, in addition to all other 
eligibility requirements and program 
criteria, factors such as whether the 
applicant has been subject to a 
termination or suspension under 
paragraph (a) of this section and 
whether the applicant or the person or 
persons who would direct or has/have 
directed the scientific and technical 
aspects of an activity has/have, in the 
judgment of the department or agency 
head, materially failed to discharge 
responsibility for the protection of the 
rights and welfare of human subjects 
(whether or not the research was subject 
to federal regulation). 


§ .124 Conditions. 


With respect to any research project 
or any Class of research projects the 
department or agency head of either the 
conducting or the supporting Federal 
department or agency may impose 
additional conditions prior to or at the 
time of approval when in the judgment 
of the department or agency head 
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additional conditions are necessary for 
the protection of human subjects. 


Adoption of the Common Rules 


The adoption of the common rules by 
the participating agencies, as modified 
by agency-specific text, is set forth 
below. 


DEPARTMENT OF HOMELAND 
SECURITY 


List of Subjects in 6 CFR Part 46 


Human research subjects, Reporting 
and record-keeping requirements, 
Research. 


m For the reasons stated in the preamble, 
the Department of Homeland Security 
adds 6 CFR part 46 as set forth at the 
end of the common preamble of this 
document. 


PART 46—PROTECTION OF HUMAN 
SUBJECTS 


Sec. 

46.101 To what does this policy apply? 

46.102 Definitions for purposes of this 
policy. 

46.103 Assuring compliance with this 
policy—research conducted or supported 
by any Federal department or agency. 


46.104 Exempt research. 
46.105 [Reserved] 
46.106 [Reserved] 
46.107 IRB membership. 


46.108 IRB functions and operations. 

46.109 IRB review of research. 

46.110 Expedited review procedures for 
certain kinds of research involving no 
more than minimal risk, and for minor 
changes in approved research. 

46.111 Criteria for IRB approval of research. 

46.112 Review by institution. 

46.113 Suspension or termination of IRB 
approval of research. 

46.114 Cooperative research. 

46.115 IRB records. 

46.116 General requirements for informed 
consent. 

46.117 Documentation of informed consent. 

46.118 Applications and proposals lacking 
definite plans for involvement of human 
subjects. 

46.119 Research undertaken without the 
intention of involving human subjects. 

46.120 Evaluation and disposition of 
applications and proposals for research 
to be conducted or supported by a 
Federal department or agency. 

46.121 [Reserved] 

46.122 Use of Federal funds. 

46.123 Early termination of research 
support: Evaluation of applications and 
proposals. 

46.124 Conditions. 


Authority: 5 U.S.C. 301; Pub. L. 107-296, 
sec. 102, 306(c); Pub. L. 108-458, sec. 8306. 


Reginald Brothers, 


Under Secretary for Science and Technology, 
DHS. 


DEPARTMENT OF AGRICULTURE 
List of Subjects in 7 CFR Part 1c 


Human research subjects, Reporting 
and record-keeping requirements, 
Research. 


m For the reasons stated in the preamble, 
the Department of Agriculture revises 7 
CFR part 1c as set forth at the end of the 
common preamble of this document. 


PART 1c—PROTECTION OF HUMAN 
SUBJECTS 


Sec. 

1c.101 To what does this policy apply? 

1c.102 Definitions for purposes of this 
policy. 

1c.103 Assuring compliance with this 
policy—research conducted or supported 
by any Federal department or agency. 

1c.104 Exempt research. 

1c.105 [Reserved] 

1c.106 [Reserved] 

1c.107 IRB membership. 

1c.108 IRB functions and operations. 

1c.109 IRB review of research. 

1c.110 Expedited review procedures for 
certain kinds of research involving no 
more than minimal risk, and for minor 
changes in approved research. 

1c.111 Criteria for IRB approval of research. 

1c.112 Review by institution. 

1c.113 Suspension or termination of IRB 
approval of research. 

1c.114 Cooperative research. 

1c.115 IRB records. 

1c.116 General requirements for informed 
consent. 

1c.117 Documentation of informed consent. 

1c.118 Applications and proposals lacking 
definite plans for involvement of human 
subjects. 

1c.119 Research undertaken without the 
intention of involving human subjects. 

1c.120 Evaluation and disposition of 
applications and proposals for research 
to be conducted or supported by a 
Federal department or agency. 

1c.121 [Reserved] 

1c.122 Use of Federal funds. 

1c.123 Early termination of research 
support: Evaluation of applications and 
proposals. 

1c.124 Conditions. 


Authority: 5 U.S.C. 301; 42 U.S.C. 300v— 
1(b). 


Ann M. Bartuska, 


Acting Under Secretary for Research, 
Education, and Economics, USDA. 


DEPARTMENT OF ENERGY 
List of Subjects in 10 CFR Part 745 
10 CFR Part 745 


Human research subjects, Reporting 
and record-keeping requirements, 
Research. 


m For the reasons stated in the preamble, 
the Department of Energy revises 10 
CFR part 745 as set forth at the end of 
the common preamble of this document. 


PART 745—PROTECTION OF HUMAN 
SUBJECTS 


Sec. 

745.101 To what does this policy apply? 

745.102 Definitions for purposes of this 
policy. 

745.103 Assuring compliance with this 
policy—research conducted or supported 
by any Federal department or agency. 

745.104 Exempt research. 

745.105 [Reserved] 

745.106 [Reserved] 

745.107 IRB membership. 

745.108 IRB functions and operations. 

745.109 IRB review of research. 

745.110 Expedited review procedures for 
certain kinds of research involving no 
more than minimal risk, and for minor 
changes in approved research. 

745.111 Criteria for IRB approval of 
research. 

745.112 Review by institution. 

745.113 Suspension or termination of IRB 
approval of research. 

745.114 Cooperative research. 

745.115 IRB records. 

745.116 General requirements for informed 
consent. 

745.117 Documentation of informed 
consent. 

745.118 Applications and proposals lacking 
definite plans for involvement of human 
subjects. 

745.119 Research undertaken without the 
intention of involving human subjects. 

745.120 Evaluation and disposition of 
applications and proposals for research 
to be conducted or supported by a 
Federal department or agency. 

745.121 [Reserved] 

745.122 Use of Federal funds. 

745.123 Early termination of research 
support: Evaluation of applications and 
proposals. 

745.124 Conditions. 
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Authority: 5 U.S.C. 301; 42 U.S.C. 7254; 42 
U.S.C. 300v—1(b). 


Elizabeth Sherwood-Randall, 
Deputy Secretary of Energy. 


NATIONAL AERONAUTICS AND 
SPACE ADMINISTRATION 


List of Subjects in 14 CFR Part 1230 
14 CFR Part 1230 


Human research subjects, Reporting 
and record-keeping requirements, 
Research. 


mw For the reasons stated in the preamble, 
the National Aeronautics and Space 
Administration revises 14 CFR part 
1230 as set forth at the end of the 
common preamble of this document. 


PART 1230—PROTECTION OF HUMAN 
SUBJECTS 


Sec. 

1230.101 To what does this policy apply? 

1230.102 Definitions for purposes of this 
policy. 

1230.103 Assuring compliance with this 
policy—research conducted or supported 
by any Federal department or agency. 

1230.104 Exempt research. 

1230.105 [Reserved] 

1230.106 [Reserved] 

1230.107 IRB membership. 

1230.108 IRB functions and operations. 

1230.109 IRB review of research. 

1230.110 Expedited review procedures for 
certain kinds of research involving no 
more than minimal risk, and for minor 
changes in approved research. 

1230.111 Criteria for IRB approval of 
research. 

1230.112 Review by institution. 

1230.113 Suspension or termination of IRB 
approval of research. 

1230.114 Cooperative research. 

1230.115 IRB records. 

1230.116 General requirements for 
informed consent. 

1230.117 Documentation of informed 
consent. 

1230.118 Applications and proposals 
lacking definite plans for involvement of 
human subjects. 

1230.119 Research undertaken without the 
intention of involving human subjects. 

1230.120 Evaluation and disposition of 
applications and proposals for research 
to be conducted or supported by a 
Federal department or agency. 

1230.121 [Reserved] 

1230.122 Use of Federal funds. 

1230.123 Early termination of research 
support: Evaluation of applications and 
proposals. 

1230.124 Conditions. 


Authority: 5 U.S.C. 301;42 U.S.C. 300v— 
1(b). 


James D. Polk, 
Chief Health and Medical Officer, NASA. 


DEPARTMENT OF COMMERCE 
List of Subjects in 15 CFR Part 27 
15 CFR Part 27 


Human research subjects, Reporting 
and record-keeping requirements, 
Research. 


m For the reasons stated in the preamble, 
the Department of Commerce revises 15 
CFR part 27 as set forth at the end of the 
common preamble of this document. 


PART 27—PROTECTION OF HUMAN 
SUBJECTS 


Sec. 

27.101 To what does this policy apply? 

27.102 Definitions for purposes of this 
policy. 

27.103 Assuring compliance with this 
policy—research conducted or supported 
by any Federal department or agency. 

27.104 Exempt research. 

27.105 [Reserved] 

27.106 [Reserved] 

27.107 IRB membership. 

27.108 IRB functions and operations. 

27.109 IRB review of research. 

27.110 Expedited review procedures for 
certain kinds of research involving no 
more than minimal risk, and for minor 
changes in approved research. 

27.111 Criteria for IRB approval of research. 

27.112 Review by institution. 

27.113 Suspension or termination of IRB 
approval of research. 

27.114 Cooperative research. 

27.115 IRB records. 

27.116 General requirements for informed 
consent. 

27.117 Documentation of informed consent. 

27.118 Applications and proposals lacking 
definite plans for involvement of human 
subjects. 

27.119 Research undertaken without the 
intention of involving human subjects. 

27.120 Evaluation and disposition of 
applications and proposals for research 
to be conducted or supported by a 
Federal department or agency. 

27.121 [Reserved] 

27.122 Use of Federal funds. 

27.123 Early termination of research 
support: Evaluation of applications and 
proposals. 

27.124 Conditions. 


Authority: 5 U.S.C. 301; 42 U.S.C. 300v— 
1(b). 


James Hock, 
Chief of Staff, Department of Commerce. 


SOCIAL SECURITY 
ADMINISTRATION 


List of Subjects in 20 CFR Part 431 
20 CFR Part 431 


Human research subjects, Reporting 
and record-keeping requirements, 
Research. 


m For the reasons stated in the preamble, 
the Social Security Administration adds 
20 CFR part 431 as set forth at the end 
of the common preamble of this 
document. 


PART 431—PROTECTION OF HUMAN 
SUBJECTS 


Sec. 

431.101 To what does this policy apply? 

431.102 Definitions for purposes of this 
policy. 

431.103 Assuring compliance with this 
policy—research conducted or supported 
by any Federal department or agency. 

431.104 Exempt research. 

431.105 [Reserved] 

431.106 [Reserved] 

431.107 IRB membership. 

431.108 IRB functions and operations. 

431.109 IRB review of research. 

431.110 Expedited review procedures for 
certain kinds of research involving no 
more than minimal risk, and for minor 
changes in approved research. 

431.111 Criteria for IRB approval of 
research. 

431.112 Review by institution. 

431.113 Suspension or termination of IRB 
approval of research. 

431.114 Cooperative research. 

431.115 IRB records. 

431.116 General requirements for informed 
consent. 

431.117 Documentation of informed 
consent. 

431.118 Applications and proposals lacking 
definite plans for involvement of human 
subjects. 

431.119 Research undertaken without the 
intention of involving human subjects. 

431.120 Evaluation and disposition of 
applications and proposals for research 
to be conducted or supported by a 
Federal department or agency. 

431.121 [Reserved] 

431.122 Use of Federal funds. 

431.123 Early termination of research 
support: Evaluation of applications and 
proposals. 

431.124 Conditions. 
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Authority: 5 U.S.C. 301; 42 U.S.C. 289(a). 


Carolyn W. Colvin, 
Acting Commissioner of Social Security. 


AGENCY FOR INTERNATIONAL 
DEVELOPMENT 


List of Subjects in 22 CFR Part 225 
22 CFR Part 225 


Human research subjects, Reporting 
and record-keeping requirements, 
Research. 


= For the reasons stated in the preamble, 
the Agency for International 
Development revises 22 CFR part 225 as 
set forth at the end of the common 
preamble of this document. 


PART 225—PROTECTION OF HUMAN 
SUBJECTS 


Sec. 

225.101 To what does this policy apply? 

225.102 Definitions for purposes of this 
policy. 

225.103 Assuring compliance with this 
policy—research conducted or supported 
by any Federal department or agency. 

225.104 Exempt research. 

225.105 [Reserved] 

225.106 [Reserved] 

225.107 IRB membership. 

225.108 IRB functions and operations. 

225.109 IRB review of research. 

225.110 Expedited review procedures for 
certain kinds of research involving no 
more than minimal risk, and for minor 
changes in approved research. 

225.111 Criteria for IRB approval of 
research. 

225.112 Review by institution. 

225.113 Suspension or termination of IRB 
approval of research. 

225.114 Cooperative research. 

225.115 IRB records. 

225.116 General requirements for informed 
consent. 

225.117 Documentation of informed 
consent. 

225.118 Applications and proposals lacking 
definite plans for involvement of human 
subjects. 

225.119 Research undertaken without the 
intention of involving human subjects. 

225.120 Evaluation and disposition of 
applications and proposals for research 
to be conducted or supported by a 
Federal department or agency. 

225.121 [Reserved] 

225.122 Use of Federal funds. 

225.123 Early termination of research 
support: Evaluation of applications and 
proposals. 

225.124 Conditions. 


Authority: 5 U.S.C. 301; 42 U.S.C. 300v— 
1(b), unless otherwise noted. 


Irene Koek, 

Acting Deputy Assistant Administrator for 
Global Health, U.S. Agency for International 
Development. 


DEPARTMENT OF HOUSING AND 
URBAN DEVELOPMENT 


List of Subjects in 24 CFR Part 60 
24 CFR Part 60 


Human research subjects, Reporting 
and record-keeping requirements, 
Research. 


m For the reasons stated in the preamble, 
the Department of Housing and Urban 
Development revises 24 CFR part 60 as 
set forth at the end of the common 
preamble of this document. 


PART 60—PROTECTION OF HUMAN 
SUBJECTS 


Sec. 

60.101 To what does this policy apply? 

60.102 Definitions for purposes of this 
policy. 

60.103 Assuring compliance with this 
policy—research conducted or supported 
by any Federal department or agency. 

60.104 Exempt research. 

60.105 [Reserved] 

60.106 [Reserved] 

60.107 IRB membership. 

60.108 IRB functions and operations. 

60.109 IRB review of research. 

60.110 Expedited review procedures for 
certain kinds of research involving no 
more than minimal risk, and for minor 
changes in approved research. 

60.111 Criteria for IRB approval of research. 

60.112 Review by institution. 

60.113 Suspension or termination of IRB 
approval of research. 

60.114 Cooperative research. 

60.115 IRB records. 

60.116 General requirements for informed 
consent. 

60.117 Documentation of informed consent. 

60.118 Applications and proposals lacking 
definite plans for involvement of human 
subjects. 

60.119 Research undertaken without the 
intention of involving human subjects. 

60.120 Evaluation and disposition of 
applications and proposals for research 
to be conducted or supported by a 
Federal department or agency. 

60.121 [Reserved] 

60.122 Use of Federal funds. 

60.123 Early termination of research 
support: Evaluation of applications and 
proposals. 

60.124 Conditions. 


Authority: 5 U.S.C. 301; 42 U.S.C. 300v— 
1(b) and 3535(d). 


Katherine M. O’Regan, 

Assistant Secretary for Policy Development 
and Research, Department of Housing and 
Urban Development. 


DEPARTMENT OF LABOR 
List of Subjects in 29 CFR Part 21 
29 CFR Part 21 


Human research subjects, Reporting 
and record-keeping requirements, 
Research. 


m For the reasons stated in the preamble, 
the Department of Labor adds 29 CFR 
part 21 as set forth at the end of the 
common preamble of this document. 


PART 21—PROTECTION OF HUMAN 
SUBJECTS 


Sec. 

21.101 To what does this policy apply? 

21.102 Definitions for purposes of this 
policy. 

21.103 Assuring compliance with this 
policy—research conducted or supported 
by any Federal department or agency. 


21.104 Exempt research. 

21.105 [Reserved] 

21.106 [Reserved] 

21.107 IRB membership. 

21.108 IRB functions and operations. 
21.109 IRB review of research. 


21.110 Expedited review procedures for 
certain kinds of research involving no 
more than minimal risk, and for minor 
changes in approved research. 

21.111 Criteria for IRB approval of research. 

21.112 Review by institution. 

21.113 Suspension or termination of IRB 
approval of research. 

21.114 Cooperative research. 

21.115 IRB records. 

21.116 General requirements for informed 
consent. 

21.117 Documentation of informed consent. 

21.118 Applications and proposals lacking 
definite plans for involvement of human 
subjects. 

21.119 Research undertaken without the 
intention of involving human subjects. 

21.120 Evaluation and disposition of 
applications and proposals for research 
to be conducted or supported by a 
Federal department or agency. 

21.121 [Reserved] 

21.122 Use of Federal funds. 

21.123 Early termination of research 
support: Evaluation of applications and 
proposals. 

21.124 Conditions. 
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Authority: 5 U.S.C. 301; 29 U.S.C. 551. 


Christopher P. Lu, 
Deputy Secretary of Labor. 


DEPARTMENT OF DEFENSE 
List of Subjects in 32 CFR Part 219 
32 CFR Part 219 


Human research subjects, Reporting 
and record-keeping requirements, 
Research. 


= For the reasons stated in the preamble, 
the Department of Defense revises 32 
CFR part 219 as set forth at the end of 
the common preamble of this document. 


PART 219—PROTECTION OF HUMAN 
SUBJECTS 


Sec. 

219.101 To what does this policy apply? 

219.102 Definitions for purposes of this 
policy. 

219.103 Assuring compliance with this 
policy—research conducted or supported 
by any Federal department or agency. 

219.104 Exempt research. 

219.105 [Reserved] 

219.106 [Reserved] 

219.107 IRB membership. 

219.108 IRB functions and operations. 

219.109 IRB review of research. 

219.110 Expedited review procedures for 
certain kinds of research involving no 
more than minimal risk, and for minor 
changes in approved research. 

219.111 Criteria for IRB approval of 
research. 

219.112 Review by institution. 

219.113 Suspension or termination of IRB 
approval of research. 

219.114 Cooperative research. 

219.115 IRB records. 

219.116 General requirements for informed 
consent. 

219.117 Documentation of informed 
consent. 

219.118 Applications and proposals lacking 
definite plans for involvement of human 
subjects. 

219.119 Research undertaken without the 
intention of involving human subjects. 

219.120 Evaluation and disposition of 
applications and proposals for research 
to be conducted or supported by a 
Federal department or agency. 

219.121 [Reserved] 

219.122 Use of Federal funds. 

219.123 Early termination of research 
support: Evaluation of applications and 
proposals. 

219.124 Conditions. 


Authority: 5 U.S.C. 301; 42 U.S.C. 300v— 
1(b). 


Stephen P. Welby, 


Assistant Secretary of Defense (Research and 
Engineering). 


DEPARTMENT OF EDUCATION 
List of Subjects in 34 CFR Part 97 


Human research subjects, Reporting 
and record-keeping requirements, 
Research. 


m For the reasons stated in the preamble, 
the Department of Education amends 34 
CFR part 97 as follows: 


PART 97—PROTECTION OF HUMAN 
SUBJECTS 


m 1. The authority citation for part 97 
continues to read as follows: 


Authority: 5 U.S.C. 301; 20 U.S.C. 1221e— 
3, 3474; 42 U.S.C. 300v-1(b). 


m 2. Subpart A is revised as set forth at 
the end of the common preamble of this 
document. 


Subpart A—Federal Policy for the 
Protection of Human Subjects (Basic 
ED Policy for Protection of Human 
Research Subjects) 


Sec. 

97.101 To what does this policy apply? 

97.102 Definitions for purposes of this 
policy. 

97.103 Assuring compliance with this 
policy—research conducted or supported 
by any Federal department or agency. 

97.104 Exempt research. 

97.105 [Reserved] 

97.106 [Reserved] 

97.107 IRB membership. 

97.108 IRB functions and operations. 

97.109 IRB review of research. 

97.110 Expedited review procedures for 
certain kinds of research involving no 
more than minimal risk, and for minor 
changes in approved research. 

97.111 Criteria for IRB approval of research. 

97.112 Review by institution. 

97.113 Suspension or termination of IRB 
approval of research. 

97.114 Cooperative research. 

97.115 IRB records. 

97.116 General requirements for informed 
consent. 

97.117 Documentation of informed consent. 

97.118 Applications and proposals lacking 
definite plans for involvement of human 
subjects. 

97.119 Research undertaken without the 
intention of involving human subjects. 

97.120 Evaluation and disposition of 
applications and proposals for research 
to be conducted or supported by a 
Federal department or agency. 

97.121 [Reserved] 

97.122 Use of Federal funds. 

97.123 Early termination of research 
support: Evaluation of applications and 
proposals. 


97.124 Conditions. 


John B. King Jr., 
Secretary of Education. 


DEPARTMENT OF VETERANS 
AFFAIRS 


List of Subjects in 38 CFR Part 16 
38 CFR Part 16 


Human research subjects, Reporting 
and record-keeping requirements, 
Research. 


= For the reasons stated in the preamble, 
the Department of Veterans Affairs 
revises 38 CFR part 16 as set forth at the 
end of the common preamble of this 
document. 


PART 16—PROTECTION OF HUMAN 
SUBJECTS 


Sec. 

16.101 To what does this policy apply? 

16.102 Definitions for purposes of this 
policy. 

16.103 Assuring compliance with this 
policy—research conducted or supported 
by any Federal department or agency. 

16.104 Exempt research. 

16.105 [Reserved] 

16.106 [Reserved] 

16.107 IRB membership. 

16.108 IRB functions and operations. 

16.109 IRB review of research. 

16.110 Expedited review procedures for 
certain kinds of research involving no 
more than minimal risk, and for minor 
changes in approved research. 

16.111 Criteria for IRB approval of research. 

16.112 Review by institution. 

16.113 Suspension or termination of IRB 
approval of research. 

16.114 Cooperative research. 

16.115 IRB records. 

16.116 General requirements for informed 
consent. 

16.117 Documentation of informed consent. 

16.118 Applications and proposals lacking 
definite plans for involvement of human 
subjects. 

16.119 Research undertaken without the 
intention of involving human subjects. 

16.120 Evaluation and disposition of 
applications and proposals for research 
to be conducted or supported by a 
Federal department or agency. 

16.121 [Reserved] 

16.122 Use of Federal funds. 

16.123 Early termination of research 
support: Evaluation of applications and 
proposals. 

16.124 Conditions. 
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Authority: 5 U.S.C. 301; 38 U.S.C. 501, 
7331, 7334; 42 U.S.C. 300v—1(b). 


Gina S. Farrisee, 


Deputy Chief of Staff, U.S. Department of 
Veterans Affairs. 


ENVIRONMENTAL PROTECTION 
AGENCY 


List of Subjects in 40 CFR Part 26 


40 CFR Part 26 


Human research subjects, Reporting 
and record-keeping requirements, 
Research. 
mw For the reasons stated in the preamble, 
the Environmental Protection Agency 
amends 40 CFR part 26 as follows: 


PART 26—PROTECTION OF HUMAN 
SUBJECTS 


m 1. The authority citation for part 26 
continues to read as follows: 


Authority: 5 U.S.C. 301; 7 U.S.C. 136a(a) 
and 136w/(a)(1); 21 U.S.C. 346a(e)(1)(C); sec. 
201, Pub. L. 109-54, 119 Stat. 531; and 42 
U.S.C. 300v—1(b). 


m 2. Subpart A is revised as set forth at 
the end of the common preamble of this 
document. 


Subpart A—Basic EPA Policy for 
Protection of Subjects in Human 
Research Conducted or Supported by 
EPA 


Sec. 

26.101 To what does this policy apply? 

26.102 Definitions for purposes of this 
policy. 

26.103 Assuring compliance with this 
policy—research conducted or supported 
by any Federal department or agency. 

26.104 Exempt research. 

26.105 [Reserved] 

26.106 [Reserved] 

26.107 IRB membership. 

26.108 IRB functions and operations. 

26.109 IRB review of research. 

26.110 Expedited review procedures for 
certain kinds of research involving no 
more than minimal risk, and for minor 
changes in approved research. 

26.111 Criteria for IRB approval of research. 

26.112 Review by institution. 

26.113 Suspension or termination of IRB 
approval of research. 

26.114 Cooperative research. 

26.115 IRB records. 

26.116 General requirements for informed 
consent. 

26.117 Documentation of informed consent. 

26.118 Applications and proposals lacking 
definite plans for involvement of human 
subjects. 

26.119 Research undertaken without the 
intention of involving human subjects. 

26.120 Evaluation and disposition of 
applications and proposals for research 
to be conducted or supported by a 
Federal department or agency. 

26.121 [Reserved] 

26.122 Use of Federal funds. 


26.123 Early termination of research 
support: Evaluation of applications and 
proposals. 

26.124 Conditions. 


A. Stanley Meiburg, 


Acting Deputy Administrator, Environmental 
Protection Agency. 


DEPARTMENT OF HEALTH AND 
HUMAN SERVICES 


List of Subjects in 45 CFR Part 46 


45 CFR Part 46 


Human research subjects, Reporting 
and record-keeping requirements, 
Research. 


= For the reasons stated in the preamble, 
the Department of Health and Human 
Services amends 45 CFR part 46 as 
follows: 


PART 46—PROTECTION OF HUMAN 
SUBJECTS 


m 1. The authority citation for part 46 is 
revised to read as follows: 


Authority: 5 U.S.C. 301; 42 U.S.C. 289(a); 
42 U.S.C. 300v—1(b). 


m 2. Subpart A is revised as set forth at 
the end of the common preamble of this 
document. 


Subpart A—Basic HHS Policy for 
Protection of Human Research 
Subjects 


Sec. 

46.101 To what does this policy apply? 

46.102 Definitions for purposes of this 
policy. 

46.103 Assuring compliance with this 
policy—research conducted or supported 
by any Federal department or agency. 

46.104 Exempt research. 

46.105 [Reserved] 

46.106 [Reserved] 

46.107 IRB membership. 

46.108 IRB functions and operations. 

46.109 IRB review of research. 

46.110 Expedited review procedures for 
certain kinds of research involving no 
more than minimal risk, and for minor 
changes in approved research. 

46.111 Criteria for IRB approval of research. 

46.112 Review by institution. 

46.113 Suspension or termination of IRB 
approval of research. 

46.114 Cooperative research. 

46.115 IRB records. 

46.116 General requirements for informed 
consent. 

46.117 Documentation of informed consent. 

46.118 Applications and proposals lacking 
definite plans for involvement of human 
subjects. 

46.119 Research undertaken without the 
intention of involving human subjects. 

46.120 Evaluation and disposition of 
applications and proposals for research 
to be conducted or supported by a 
Federal department or agency. 

46.121 [Reserved] 

46.122 Use of Federal funds. 


46.123 Early termination of research 
support: Evaluation of applications and 
proposals. 

46.124 Conditions. 


Sylvia M. Burwell, 
Secretary, HHS. 


NATIONAL SCIENCE FOUNDATION 
List of Subjects in 45 CFR Part 690 
45 CFR Part 690 


Human research subjects, Reporting 
and record-keeping requirements, 
Research. 


m For the reasons stated in the preamble, 
the National Science Foundation revises 
45 CFR part 690 as set forth at the end 
of the common preamble of this 
document. 


PART 690—PROTECTION OF HUMAN 
SUBJECTS 


Sec. 

690.101 To what does this policy apply? 

690.102 Definitions for purposes of this 
policy. 

690.103 Assuring compliance with this 
policy—research conducted or supported 
by any Federal department or agency. 

690.104 Exempt research. 

690.105 [Reserved] 

690.106 [Reserved] 

690.107 IRB membership. 

690.108 IRB functions and operations. 

690.109 IRB review of research. 

690.110 Expedited review procedures for 
certain kinds of research involving no 
more than minimal risk, and for minor 
changes in approved research. 

690.111 Criteria for IRB approval of 
research. 

690.112 Review by institution. 

690.113 Suspension or termination of IRB 
approval of research. 

690.114 Cooperative research. 

690.115 IRB records. 

690.116 General requirements for informed 
consent. 

690.117 Documentation of informed 
consent. 

690.118 Applications and proposals lacking 
definite plans for involvement of human 
subjects. 

690.119 Research undertaken without the 
intention of involving human subjects. 

690.120 Evaluation and disposition of 
applications and proposals for research 
to be conducted or supported by a 
Federal department or agency. 

690.121 [Reserved] 

690.122 Use of Federal funds. 

690.123 Early termination of research 
support: Evaluation of applications and 
proposals. 

690.124 Conditions. 
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Authority: 5 U.S.C. 301; 42 U.S.C. 300v— 
1(b). 


Lawrence Rudolph, 


General Counsel, National Science 
Foundation. 


DEPARTMENT OF 
TRANSPORTATION 


List of Subjects in 49 CFR Part 11 
49 CFR Part 11 


Human research subjects, Reporting 
and record-keeping requirements, 
Research. 


m For the reasons stated in the preamble, 
the Department of Transportation 
revises 49 CFR part 11 as set forth at the 
end of the common preamble of this 
document. 


PART 11—PROTECTION OF HUMAN 
SUBJECTS 


Sec. 

11.101 To what does this policy apply? 

11.102 Definitions for purposes of this 
policy. 

11.103 Assuring compliance with this 
policy—research conducted or supported 
by any Federal department or agency. 

11.104 Exempt research. 

11.105 [Reserved] 

11.106 [Reserved] 

11.107 IRB membership. 

11.108 IRB functions and operations. 

11.109 IRB review of research. 

11.110 Expedited review procedures for 
certain kinds of research involving no 
more than minimal risk, and for minor 
changes in approved research. 

11.111 Criteria for IRB approval of research. 

11.112 Review by institution. 

11.113 Suspension or termination of IRB 
approval of research. 

11.114 Cooperative research. 

11.115 IRB records. 


11.116 General requirements for informed 
consent. 

11.117 Documentation of informed consent. 

11.118 Applications and proposals lacking 
definite plans for involvement of human 
subjects. 

11.119 Research undertaken without the 
intention of involving human subjects. 

11.120 Evaluation and disposition of 
applications and proposals for research 
to be conducted or supported by a 
Federal department or agency. 

11.121 [Reserved] 

11.122 Use of Federal funds. 

11.123 Early termination of research 
support: Evaluation of applications and 
proposals. 

11.124 Conditions. 


Authority: 5 U.S.C. 301; 42 U.S.C. 300v— 
1(b). 
Anthony R. Foxx, 
Secretary of Transportation. 
[FR Doc. 2017-01058 Filed 1-18-17; 8:45 am] 
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